Protected health information, protected by design.
We handle PHI on behalf of US healthcare providers. Every workflow, including our AI assistants, is built around the HIPAA Privacy, Security and Breach Notification Rules.
We act as your business associate.
Before any PHI is shared, we sign a Business Associate Agreement with each client. We use PHI only to deliver the services you contract us for, and only the minimum necessary.
This page summarizes our program. Specific commitments for your organization are set out in your BAA and services agreement.
Privacy
Minimum necessary use. PHI is never used for marketing or unrelated purposes.
Security
Administrative, physical and technical safeguards that protect electronic PHI.
Accountability
Audit trails, trained staff and a clear process if something goes wrong.
Three layers of safeguards.
Administrative, physical and technical controls working together.
- Designated privacy and security lead
- Written policies and procedures
- HIPAA training at onboarding and every year
- Periodic risk analysis and review
- Subcontractors bound by BAAs
- Work areas and devices access-controlled
- Workstations auto-lock when idle
- No PHI on personal devices or removable media
- Secure disposal of media
- Unique user IDs with multi-factor sign-in
- Role-based, least-privilege access
- Encryption in transit and at rest
- Audit logs on access to PHI
- Automatic session timeout and secure backups
Controls at every step.
Share securely
Secure channels, never plain email.
Store encrypted
Kept separate for each client.
Assistant in scope
Uses only your data.
Specialist reviews
Role-based, every view logged.
Return & log
Answers go to authorized users.
How our assistants handle protected information.
AI is held to the same rules as every other part of the service.
Scoped to one client
Each client’s assistant uses only that client’s data. One client’s information never appears in another’s answers.
Role-based answers
Front-desk users and practice managers can be allowed different details, following your approved user list.
Humans stay accountable
The assistant does not make clinical or payment decisions. Specialists verify and own exceptions.
Everything is logged
Requests, answers and reports sent are recorded with who asked and when.
No PHI in public demos
Examples on this website use synthetic data only. Please do not send PHI through the contact form.
Retention and return
At the end of the service, data is returned or securely destroyed as agreed in the BAA.
If something goes wrong, we are prepared.
A defined incident response, ready before it is needed.
What we ask of our clients
- Share the minimum necessary information
- Use our secure channels, never plain email
- Keep your user list current
- Tell us at once about a suspected incident
Detect
Monitoring and staff reports flag a possible issue.
Contain
Access is limited and the cause is stopped.
Assess
We determine what information was involved.
Notify
Affected clients are told without unreasonable delay, per your BAA and the HIPAA Breach Notification Rule.
Improve
We fix the cause and update our safeguards.
Common security questions.
Do you sign a BAA?
Yes. A Business Associate Agreement is signed before any PHI is shared.
Can your staff see every client’s data?
No. Access is role-based and limited to the client and task a person is assigned to.
Does the AI assistant share data between clients?
No. Each client’s assistant is scoped to that client’s data only.
Do you use patient data to train AI models?
No. Patient data is used to deliver your services, not to train general-purpose models.
Can I see your security documentation?
Yes. Ask us and we will share our security and privacy overview during your discovery call.
What happens to our data when the service ends?
Data is returned or securely destroyed as agreed in the BAA.
Request our security overview.
Book a short discovery call. We will learn how your billing runs today and show you what a more connected approach could look like.
PHI, protected by design.
A BAA before any PHI, encryption, role-based access and audit logs.
Administrative
- Privacy and security lead
- Written policies
- HIPAA training yearly
- Periodic risk analysis
Physical
- Access-controlled work areas
- Auto-locking workstations
- No PHI on personal devices
Technical
- Multi-factor sign-in
- Role-based access
- Encryption and audit logs
Do you sign a BAA?
Yes. A Business Associate Agreement is signed before any PHI is shared.
Does the AI share data between clients?
No. Each client’s assistant is scoped to that client’s data only.
Do you train AI on patient data?
No. Patient data is used to deliver your services only.
Request our security overview.
Book a short discovery call. No patient information needed.
Book a discovery callSample data only. No real patient information.