VisitRounds Scope and roles
VisitRounds is a clinical documentation platform built with software customized by BlackBezel Technologies and provided to healthcare organizations under a written agreement.
For patient information, the healthcare organization and its clinicians are the healthcare provider: in the United States the covered entity, in Canada the custodian or organization. VisitRounds processes that information only on their behalf and only to provide the service. This notice does not replace the organization's Notice of Privacy Practices, which governs patients' rights under HIPAA.
What we collect
- Clinician accounts
- Name, username, email, role, module, and a salted, iterated password hash. Passwords themselves are never stored.
- Clinical content
- Patient identifiers entered by clinicians (name, date of birth, MRN, medications), dictation audio, transcripts, draft and signed notes, addenda, CPT/HCPCS codes, census lists, and census page images while a census is read.
- Security records
- An audit log of sign-ins and actions on records: who, what, when, and the network address. Audit entries hold fixed values only, never note text.
- Website inquiries
- Name, email and message sent through Contact us. Never include patient information there.
How it is used
- To transcribe dictation, draft notes in the clinician's templates, and check documentation against a selected CPT code.
- To keep each physician's patients, notes and bills available to that physician, and the daily census lists available to the practice's signed-in clinicians.
- To secure the service: sign-in, session timeouts, abuse prevention and audit.
- Never for advertising, never sold, never used to train models.
Language technology processing
Language technology assists; it never decides. Every output is a draft that a qualified, licensed clinician reviews, edits and signs. The system is instructed never to add content that was not dictated, marks uncertain words for review, and never bills anything automatically.
Speech recognition and note drafting are performed by HIPAA-compliant technology partners under Business Associate Agreements, and patient audio is never used for model improvement. Search runs inside VisitRounds itself and sends no patient text anywhere.
Retention
- Audio
- Deleted as soon as it has been transcribed. A copy kept on the clinician's own device for crash recovery is discarded after 7 days, the next time the app opens the dictation screen on that device.
- Signed notes
- Medical records: locked, corrected only by addenda, and kept for as long as the organization's record-retention policy and law require.
- Unfinished drafts
- Can be discarded by their author.
- Audit records
- Kept to meet security and accountability requirements.
- Website inquiries
- Kept only to respond.
Security
- Encryption in transit
- TLS on every connection, with HTTP Strict Transport Security.
- Access control
- Each physician sees only their own patients and notes, and the daily census lists are shared with the practice's signed-in clinicians; roles for administrators and managers; sign-in locked for 15 minutes after repeated failures.
- Sessions
- Server-side sessions that can be revoked, ending after 30 minutes without activity; a dictation in progress keeps the session alive.
- Secrets
- Credentials for connected technology encrypted at rest; never written to logs.
- Browser hardening
- Content Security Policy, frame denial and no referrer leakage.
- Logging discipline
- Errors are logged by type and record number only; transcript and note text never appear in logs.
The controls are summarized on the Security and compliance page.
Your choices and rights
- Patients
- Requests to access, amend or receive an accounting of disclosures of health information are handled by the healthcare organization under its Notice of Privacy Practices and applicable law, including HIPAA in the United States and PIPEDA or provincial health privacy law in Canada.
- Clinicians and website visitors
- You may ask what information is held about you, ask for corrections, or ask for deletion where retention is not required by law.
Changes and questions
Material changes are published here with a new version number and date. Privacy questions or concerns are raised under the enterprise agreement, without patient information, or with your organization's privacy officer directly.
This notice describes how the platform is built and operated. It is not legal advice.