HIPAA & security

Business associate agreement

We sign a business associate agreement with every customer before any protected health information is transmitted to us — on every plan, including trials and pilots. The agreement sets out permitted uses, breach notification obligations, subcontractor flow-down terms and our duties on termination.

If your compliance team needs to review our standard terms before a pilot, ask and we will send them.

Technical safeguards

Our controls are mapped to the HIPAA Security Rule and reviewed on a regular cycle.

• TLS 1.2 or higher for all data in transit, AES-256 for data at rest.
• Key management separated from application-level access.
• Role-based access scoped to the minimum necessary, with SSO and SCIM available on system plans.
• Immutable audit logging of every access to a patient record, exportable on request.
• Data processed and stored in United States regions only.
• Segregated environments, with no production PHI in development or testing systems.

Organisational safeguards

Every employee completes HIPAA training on joining and annually thereafter. Access to production systems is granted on a need-to-know basis, reviewed quarterly, and revoked the day someone changes role or leaves. Subcontractors that could encounter PHI are themselves bound by business associate agreements.

We maintain an incident response plan with defined breach assessment and notification timelines, and we test it.

How we govern the AI

Customer clinical data is not used to train models shared with other customers. Model outputs are treated as drafts: a qualified person on your team reviews and approves every request and every appeal before it is transmitted to a payer.

Extracted values and quoted guidance link back to their source so a reviewer can verify rather than trust. Where the system is uncertain, it says so and flags the field instead of guessing.

Assurance and audits

We run a SOC 2 Type II programme covering security and availability, and we will share our current report and penetration testing summary under NDA as part of your vendor review.