Wrong question. Hermes Agent is MIT-licensed software that runs on your own machine or server, so no vendor receives data from the binary and there is nobody to sign a Business Associate Agreement with. That only holds if you also run the model yourself. Nous Research sells hosted services — Nous Portal, the Tool Gateway and the preview Hermes Cloud — that do receive prompts, and no Nous document we read mentions HIPAA, PHI or a business associate. Re-plumbing an agent so no third party sees prompts takes us 6–10 weeks.
| Fact | Value |
|---|---|
| Tool | Hermes |
| Verdict | Not the right question |
| Sources checked | August 2026 |
| Typical range | $13,000–$25,000 |
| Typical timeline | 6–10 weeks |
| Last updated | August 2026 |
Which surfaces a Nous agreement reaches
"Covered" here would mean named in a Business Associate Agreement offered by Nous Research. No such agreement exists in any Nous document we could find, so nothing on this table is covered — but the reasons differ surface by surface, and that distinction is the whole page. For the self-hosted binary there is no vendor in the path to cover anything. For the hosted products there is a vendor in the path, and no agreement on offer. Absence of a mention is not the same as a vendor telling you no: no Nous document names protected health information at all.
Your PHI
Your Hermes app
Outside it — PHI here is a gap
- Hermes Agent (self-hosted CLI, TUI and gateway, MIT licence)
- Nous Portal (subscription inference gateway)
- Nous Tool Gateway (Firecrawl, FAL, OpenAI TTS, Browser Use, Modal)
- Hermes Cloud (Nous-hosted always-on agents, preview)
- Messaging gateway (WhatsApp, Signal, Telegram, Slack, SMS, email and fourteen more)
- Hermes Relay (experimental external connector)
- Langfuse observability plugin (bundled, off by default)
- Nous Chat, Hermes 4, Simulators
| Service | Under the BAA | Condition |
|---|---|---|
| Hermes Agent (self-hosted CLI, TUI and gateway, MIT licence) | Not covered | No vendor receives data from the binary itself — local telemetry is opt-in and the code comment states no remote sink exists. This holds only while the model endpoint is one you run, the Tool Gateway is off for every tool, no MCP servers are attached, no messaging platform is connected and the Langfuse plugin is not enabled. |
| Nous Portal (subscription inference gateway) | Not covered | A paid Nous Research proxy that receives every prompt. The docs call it the recommended way to run Hermes Agent. No BAA is offered or mentioned, and the Portal re-routes models between backends, so you cannot name your own sub-processors. |
| Nous Tool Gateway (Firecrawl, FAL, OpenAI TTS, Browser Use, Modal) | Not covered | A separate egress from inference: web search and extract, image generation, text-to-speech, cloud browser automation and a cloud terminal sandbox, routed through Nous-managed infrastructure. It is opt-in per tool, so it can be on while your model runs locally. |
| Hermes Cloud (Nous-hosted always-on agents, preview) | Not covered | Nous-hosted, always on, with the agent's memory living on Nous infrastructure rather than your device. No BAA is offered or mentioned. Where that data is stored and how long it is kept between sessions we could not verify — those FAQ answers render only in a browser and are absent from the served page. |
| Messaging gateway (WhatsApp, Signal, Telegram, Slack, SMS, email and fourteen more) | Not covered | Nous Research is not in this path at all — the gateway holds your own bot tokens and talks to each platform directly. That means each platform is your counterparty, and no Nous agreement reaches any of them. The default WhatsApp route is an unofficial bridge emulating a WhatsApp Web session, with no Meta business relationship. |
| Hermes Relay (experimental external connector) | Not covered | An experimental connector that owns the platform credentials instead of your own machine. No BAA is offered or mentioned. |
| Langfuse observability plugin (bundled, off by default) | Not covered | Not a Nous service. The plugin traces conversations, model calls and tool usage, and its default destination is a third-party cloud. Its default capture mode redacts secret patterns, which means API keys — not patient names. |
| Nous Chat, Hermes 4, Simulators | Not covered | Other Nous surfaces governed by the same Privacy Policy. No BAA is offered or mentioned for any of them. |
This table reflects the documents as we read them in August 2026. The Privacy Policy carried "Last Updated: June 11, 2026"; the Terms of Service printed no effective date at all, which means you cannot tell from the page whether the version you are reading is the one you agreed to. The repository was last pushed on 26 August 2026 and Hermes Cloud is in preview, so surfaces can appear and change between releases. Re-read the Privacy Policy, the Terms and the integrations documentation yourself before relying on any row here.
Why the self-hosted framing is only half of the answer
What secondary sources say
The summary that circulates is that Hermes Agent is open source, MIT-licensed and runs on your own hardware, therefore no vendor receives your data and the HIPAA question does not arise. Every clause in that sentence is true about the binary.
- The Privacy Policy pulls in the opposite direction and confuses readers the other way: its scope names "Hermes and other AI models, agents, and inference tools made available by Nous", which reads as though the local binary reports your prompts to Nous. It does not — the local telemetry code comment states collection is opt-in and no remote sink exists.
What the vendor's own documentation says
The agent cannot run without an inference endpoint, and the vendor's own documentation points that endpoint at itself: Nous Portal is described as "Nous Research's unified subscription gateway and the recommended way to run Hermes Agent". The same subscription carries the Tool Gateway, which the documentation describes as routing the agent's tool calls through Nous-managed infrastructure and states is "opt-in per tool, not all-or-nothing". The Privacy Policy for those hosted services says prompts are collected, and that Nous may disclose them to "affiliates, business partners, research collaborators, infrastructure providers, analytics providers, model providers, and other third parties".
How we resolve it
Both statements are correct about different things. The MIT binary is silent — its telemetry is opt-in and the code comment says no remote sink exists. The moment someone follows the recommended quickstart, prompts leave for Nous Portal, and the self-hosted framing stops describing the deployment. So do not audit the licence; audit the prompt path. Ask which endpoint the model requests go to, which tools are on the gateway, which MCP servers are attached and which chat platforms the gateway is connected to. The licence tells you nothing about any of those.
Where a pasted prompt actually goes
The inference endpoint every prompt is sent to
HighThe agent needs a model. If it points at Nous Portal — the setup the documentation recommends — every prompt a developer types, every file the agent reads into context and every error string it quotes back reaches Nous Research. The Privacy Policy for that service lists "prompts, instructions, messages, uploads, inputs, outputs, responses, conversation history" among the data collected, and permits use for training and product improvement unless someone has turned Privacy Mode on. Portal also re-routes models between backends and says that routing can change over time, so you cannot produce a stable list of who processed a given prompt.
How to check
Open the profile configuration file the agent reads at startup and look at the model endpoint value. If it is a Nous Portal address rather than a host you operate, prompts are leaving the building. Then sign in at portal.nousresearch.com and look at the usage on your subscription — billed requests are prompts that went through Nous.
The Tool Gateway, which is a second exit and survives choosing your own model
HighTool calls carry prompt content. A web search built from a patient's symptoms, an image generated from a description, a page read aloud through text-to-speech, a browser session driven in the cloud, a command run in a cloud sandbox — the Gateway routes these through Nous-managed infrastructure to Firecrawl, FAL, OpenAI TTS, Browser Use and Modal. Because it is enabled per tool rather than all at once, a team can move inference onto a local model, believe the job is done, and still be shipping search queries and image prompts to five outside services.
How to check
In the same profile configuration, read the tool settings one tool at a time rather than looking for a single on/off switch. Anything routed through the Gateway is an outside recipient, whatever your model endpoint says.
The messaging gateway, where a clinician answers the agent from a phone
HighThe gateway connects the agent to twenty messaging platforms — including WhatsApp, Signal, Telegram, Slack, SMS and email — plus your own browser. This is the sharpest risk on the page because the person on the other end is often not a developer: a nurse or a clinician replies to the agent with a patient's name to answer its question, and that message is a disclosure to the platform carrying it. Nous Research is not in this path — the gateway holds your own bot tokens and talks to each platform directly — which means each platform is your counterparty and no Nous agreement reaches any of them. The default WhatsApp route is an unofficial bridge emulating a WhatsApp Web session, with no Meta business relationship at all and, in the documentation's own words, one that "carries a small risk of account restrictions".
How to check
Open the chat with the agent on each connected platform and scroll back through it. Search the thread for a real surname, a date of birth or a record-number prefix you know is genuine. Whatever you find there is already in that platform's hands.
Hermes Cloud, where the agent's memory stops living on your device
HighHermes Cloud runs the agent on Nous infrastructure and keeps its memory there. The product copy is explicit that memory lives with the agent rather than the device, and that the agent runs while you sleep. For a healthcare user that changes the question from what your team pasted today to what the agent has accumulated since the day it was deployed. It is in preview, no BAA is offered or mentioned, and the answers about server location and what the agent keeps between sessions are not present in the served page, so we cannot tell you where that memory sits.
How to check
Sign in at portal.nousresearch.com and open the Cloud section. If a cloud agent is deployed, treat everything it has learned as being on someone else's infrastructure, and ask Nous in writing where it is stored before you deploy another.
The observability plugin someone enables to debug the agent
MediumA bundled plugin traces conversations, model calls and tool usage, and its default destination is a third-party observability cloud. It is inert until it is listed in the enabled plugins and given credentials, so it is switched on deliberately — usually by an engineer chasing a bug at speed, and usually without a vendor review. Its default capture mode redacts secret patterns and truncates content, which protects API keys and does nothing at all for a patient name in a conversation.
How to check
Read the enabled plugins list in the profile configuration. If the tracing plugin is there, open the traces in that observability tool and read the message bodies, not the trace names.
MCP servers attached to the agent
MediumEach MCP server the agent is connected to receives the arguments of every call it is asked to make, and those arguments are written from the conversation. A server run by a third party is a third-party recipient of prompt content, with a contract of its own or none. The project's security documentation is about local trust boundaries — command approval, container isolation, credential filtering — and says nothing about regulatory compliance, data residency or retention.
How to check
Read the MCP server list in the profile configuration and, for each entry, decide whether it runs on your own machine or somewhere else. Anything not on your own machine needs its own agreement, from a vendor Nous has no relationship with.
Six checks before you talk to anyone
Each of these is a yes or no, answerable in about a minute by whoever has admin access to the agent's configuration and the Nous Portal account. Run them before you pay anyone, including us. On this tool the answers usually decide the whole question in ten minutes.
01Is the agent's model endpoint a Nous Portal address rather than a model you host yourself?
02In Account Settings → Privacy Settings on portal.nousresearch.com, is Privacy Mode switched off?
03Is the Tool Gateway enabled for any single tool — search, images, speech, browser or terminal?
04Is the messaging gateway connected to any platform — WhatsApp, Signal, Telegram, Slack, SMS or email?
05Does the enabled plugins list include the bundled observability tracing plugin?
06Open the agent's conversation history and the chat on every connected platform, and search for a real surname or record number. Do you find one?
What we do about it
Typical range
$13,000–$25,000
Typical timeline
6–10 weeks
- 01
Prompt-path map
1 weekA one-page map of every route a prompt can take out of your deployment — model endpoint, each Tool Gateway tool, each MCP server, each connected chat platform, the tracing plugin and any cloud agent — with the recipient named for each and the date we read each document printed on it.
- 02
Inference cutover
2–3 weeksThe agent moved off any hosted proxy onto an inference endpoint you control, or onto a model provider you hold your own agreement with, with the configuration under version control so the endpoint cannot drift back.
- 03
Integration teardown and re-plumbing
2–3 weeksTool Gateway routes closed or replaced tool by tool, MCP servers moved onto your own infrastructure or dropped, the tracing plugin removed or repointed, and the messaging gateway either disconnected or reduced to a channel your organisation already has an agreement for.
- 04
History sweep
1–2 weeksA written account of what already left — conversation history, Portal usage, platform chat threads, traces in the observability account, and any memory held by a deployed cloud agent — with what we could delete, what we could not, and who to ask for the rest.
- 05
Handover pack
3–5 daysThe prompt-path map, the checks we ran, the dated source pages behind each decision, the configuration your team has to keep in place, and an explicit list of what remains your responsibility — the document your auditor will ask for.
What moves the number
- Whether one deployment exists or every developer runs their own copy with their own configuration file, which turns a cutover into a fleet change.
- Whether you can host the model yourself, or need a provider you hold your own agreement with — the second path adds procurement time we do not control.
- How many chat platforms the gateway is connected to, and whether non-developers have been messaging the agent, because that history has to be read rather than guessed at.
- Whether a cloud agent has been deployed and running, since persistent memory on someone else's infrastructure takes longer to account for than a local session log.
- How many MCP servers and tools are wired in, since each one is a separate recipient with its own terms to read and its own owner to write to.
When not to hire us
- You have no real patient data in the system yet. On a synthetic dataset none of this matters, and doing it before the deployment shape settles means doing it twice.
- You already run the model yourself with every integration off. Then the self-check above is the entire audit, and the answer is that nobody outside your building has your prompts.
- You are looking for someone to sign a business associate agreement for Hermes Agent. Nobody can: it is MIT-licensed software with no vendor in the data path, and we do not become your business associate for the part of the system we do not operate.
- You are shopping for a compliance certificate. There is no government HIPAA certification, so nobody can sell you one — us included.
Worth knowing either way
There is no government HIPAA certification
No authority certifies software as HIPAA-compliant. What exists is a signed Business Associate Agreement with every vendor that touches protected health information, plus the administrative, physical and technical safeguards you implement and document yourself.
SOC 2 is not a substitute for a BAA
Supabase states it plainly in its own documentation: “SOC 2 does not cover, nor is it a substitute for, compliance with the Health Insurance Portability and Accountability Act (HIPAA).” The same holds for every vendor here.
An absence of documentation is not a vendor promise
Several answers here rest on what vendor documents do not say. We name which documents we read and when. A vendor that has never published a HIPAA position may still decline to sign, and one that publishes nothing today may publish something next quarter.
The same question, for the other fifteen tools
Firebase
NoOnly the Google Cloud equivalents are covered — no Firebase-branded service is
Supabase
Yes, with conditionsBAA plus a paid HIPAA add-on, on the Team plan or above
v0 by Vercel
PartiallyVercel hosting is covered; v0 itself is contractually off-limits for PHI
Lovable
NoIts terms prohibit uploading protected health information
Bubble
NoIts own documentation says apps built on Bubble won't achieve compliance
Replit
NoIts Terms, Commercial Agreement and DPA carry no HIPAA or BAA terms
Bolt.new
NoNo BAA in the StackBlitz and Bolt documents we read; HIPAA is named only for self-hosted
FlutterFlow
NoIts terms bar processing HIPAA-protected data outright
Claude Code
Yes, with conditionsCovered only with zero data retention, on accounts Anthropic qualifies
Codex
Yes, with conditionsCodex Local on a Regulated or Healthcare tier; Codex Cloud is excluded
Cursor
Yes, with conditionsEnterprise only, with Privacy Mode locked organisation-wide
GitHub Copilot
NoNo BAA offered; the Data Protection Agreement tells customers not to send PHI
Devin
NoPHI is Prohibited Data under the acceptable-use policy
Hermes Agent
Not the right questionSelf-hosted — the agreement you need is with your model provider
OpenClaw
Not the right questionSelf-hosted — but the vendor-run router still receives prompts
Base44
NoNo BAA; its terms ask customers to keep PHI off the platform
Sources, quoted as printed
Every claim above traces to one of these. Quotes are reproduced as printed on the source page, one source per entry, with no splicing between documents. Where a finding rests on searching a document rather than on a sentence the vendor wrote, the claim says so in our own words and no quotation is dressed up around it.
The agent is MIT-licensed and self-hosted, and the binary has no remote destination for its own telemetry. Both halves come from the same repository: the LICENSE file carries the MIT licence, and the default configuration file quoted here states that local metrics collection is opt-in with no remote sink, which is why nothing leaves the machine from the agent itself.
# Privacy-safe aggregate metrics written only to this profile's local telemetry directory. Collection is opt-in and no remote sink exists.
Hermes Agent repository — LICENSE and hermes_cli/config_defaults.pySource dated: No date printed in the file; repository main branch, last pushed 26 August 2026Checked: August 2026No Nous Research document mentions HIPAA, protected health information or a business associate agreement. We searched the full repository — including the documentation source under the website directory — for "hipaa", "business associate" and "protected health information" and found no matching file, and we found no such statement in the security documentation, the Terms of Service or the Privacy Policy either. The only healthcare-adjacent language anywhere is a prohibition in the Terms, quoted here.
use the Nous Research Services in connection with any activities that pose a risk of death or bodily harm, including autonomous weapons systems, critical infrastructure control, or medical diagnosis without qualified human oversight
Nous Research — Terms of ServiceSource dated: No Last Updated or effective date printed on the pageChecked: August 2026The hosted services collect prompts by default, and the Privacy Policy lists what that includes.
AI workflow data, such as prompts, instructions, messages, uploads, inputs, outputs, responses, conversation history, tool interactions, inference requests, API calls, telemetry, usage logs, and related interaction data generated through your use of the Services;
Those prompts may be disclosed to a broad and unnamed set of third parties, including for training.
Additionally, we may disclose personal information and Service-related data, including prompts, inputs, outputs, usage data, telemetry, trace data, and related interaction information, with affiliates, business partners, research collaborators, infrastructure providers, analytics providers, model providers, and other third parties for purposes consistent with this Privacy Policy, including to provide, operate, improve, develop, analyze, train, fine-tune, evaluate, secure, and support the Services and related technologies.
The only opt-out is an account toggle called Privacy Mode, and the Policy states its limits: it is prospective and does not reach what was already used.
Privacy Mode may apply only on a prospective basis and may not affect information that was collected, processed, incorporated into models, or otherwise used prior to the activation of Privacy Mode.
Nous Portal is a re-router, which is why you cannot produce a list of who processed a given prompt even if you would otherwise hold an agreement with a model provider.
Under the hood, the Portal routes each model to the backend best suited for it — some models go through OpenRouter, others through proprietary or secondary providers, and the routing for a given model can change over time.
Hermes Agent documentation — Nous Portal integrationSource dated: No date printed on the page; site footer reads "Hermes Agent v0.20.5 / Nous Research / MIT License • 2026"Checked: August 2026The Tool Gateway is a separate egress from inference and is configured tool by tool, so it can be active while the model runs locally.
The Tool Gateway is opt-in per tool, not all-or-nothing.
Hermes Agent documentation — Nous Portal integration (Tool Gateway)Source dated: No date printed on the pageChecked: August 2026The messaging gateway connects the agent to twenty-one surfaces, each of which receives message content directly under your own credentials.
Chat with Hermes from Telegram, Discord, Slack, WhatsApp, Signal, SMS, Email, Home Assistant, Mattermost, Matrix, DingTalk, Feishu/Lark, WeCom, Weixin, BlueBubbles (iMessage), QQ, Yuanbao, Microsoft Teams, LINE, ntfy, or your browser.
The default WhatsApp route is an unofficial bridge emulating a browser session, not the official business API, and the documentation warns about it in its own words.
WhatsApp does not officially support third-party bots outside the Business API. Using a third-party bridge carries a small risk of account restrictions.
Hermes Agent documentation source — website/docs/user-guide/messaging/whatsapp.mdSource dated: No date printed in the file; repository main branch, last pushed 26 August 2026Checked: August 2026Hermes Cloud is a Nous-hosted, always-on product in preview, which is the surface that most clearly would need a business associate agreement.
An always-on autonomous agent in the cloud, it remembers what it learns and gets more capable the longer it runs.
Nous Portal — Hermes CloudSource dated: No date printed on the page; the page states "Hermes Cloud is currently in preview."Checked: August 2026We could not verify where Hermes Cloud stores data or what it keeps between sessions. The page's FAQ questions include "Where are the servers located?" and "Does my agent keep its data between sessions?", but their answers are rendered only in a browser — the served page contains the empty containers and not the text — so we make no claim about residency or retention for that product.
Hermes Cloud is currently in preview.
Hermes Agent is a recent release from Nous Research, listed on the vendor's own releases index. The public launch date is not the same as the repository history — the repository predates it — so we cite the vendor's date for the launch only.
Hermes Agent | AGENT | An autonomous agent that lives on your server, remembers what it learns, and gets more capable the longer it runs. | 02/25/26
Frequently asked questions
It is MIT-licensed and runs on our own box. Isn't that the end of the conversation?
It ends the vendor conversation and starts the configuration one. No vendor receives data from the binary, and its own metrics are opt-in with no remote destination. But the agent needs a model, and the documentation's recommended setup sends every prompt to Nous Portal. It also ships a tool gateway, a messaging gateway covering twenty messaging platforms, MCP support and a tracing plugin. Each of those is a way for prompt text to leave. The licence tells you nothing about which of them are on.
Will Nous Research sign a BAA for Nous Portal or Hermes Cloud?
We have no evidence either way, and that is the honest answer. We searched the whole repository, the documentation site, the Terms of Service and the Privacy Policy for HIPAA, protected health information and business associate, and found nothing. Nobody has said no to you — no document addresses the subject at all. If you need one, ask them directly and get the answer in writing. Hermes Cloud is in preview and its support runs through Discord and a support mailbox, which tells you something about how mature that conversation is likely to be.
We turned on Privacy Mode. Does that solve it?
It changes the default and it is worth doing, but it is an account toggle, not zero data retention and not an agreement. The Privacy Policy states it may apply only on a prospective basis and may not affect information collected or incorporated into models beforehand, and that it does not stop the collection of operational metadata needed to run, route, secure, debug or bill for the service. So it does not help with what your team already pasted, and it does not create a counterparty who owes you anything under HIPAA.
We point the model at our own server. Are we clear?
You have closed the largest exit, not all of them. The Tool Gateway is configured per tool rather than globally, so web search, image generation, speech, cloud browser and cloud terminal calls can still be routed through Nous-managed infrastructure to five outside partners. MCP servers running elsewhere receive call arguments written from the conversation. A connected chat platform receives every message. Check those four things one at a time, because none of them follows the model setting.
Our nurses answer the agent over WhatsApp. How bad is that?
It is the sharpest issue on this page. Those messages go to the platform under your own credentials — Nous is not in the path, which also means no Nous agreement touches it. Your counterparty is Meta, or Telegram, or whoever carries the channel, and you would need a business associate agreement from each platform you connect. We checked Nous Research's documents, not the terms of the twenty platforms the gateway supports, so ask each one yourself; we did not survey those platforms' own terms, so treat each connected platform as a separate agreement you would have to obtain. The default WhatsApp route makes it worse: it is an unofficial bridge emulating a browser session, with no business relationship and, in the documentation's own words, it "carries a small risk of account restrictions".
Is there any wording in the Terms that matters to a clinical product?
One clause, and it is not about data. The Terms list, among prohibited activities alongside autonomous weapons systems and critical infrastructure control, use of the services for "medical diagnosis without qualified human oversight". Read that before you design a workflow where the agent's output reaches a clinician unreviewed. The Terms also contain a controller-and-processor clause that reads like a data protection agreement — it is not a business associate agreement, and it does not contain the terms HIPAA requires.
How long does the re-plumbing take, and what does it cost?
Six to ten weeks at $13,000–$25,000 for the engagement described above. The prompt-path map comes first and is the cheapest part; the inference cutover and the integration teardown are the bulk of it. What pushes a project towards ten weeks is rarely the code — it is several developers each running their own configuration, or a chat history long enough that someone has to read it rather than guess.
This page reports what Nous Research's published documents and repository said on the dates shown and is technical information rather than legal advice; HIPAA compliance is a property of your whole system and the processes around it rather than of any single tool, and vendor terms change — verify the current Terms, Privacy Policy and integration documentation yourself before relying on anything here.
