Security and compliance

Built to HIPAA and SOC 2 standards. Private enterprise use only.

Encryption: TLS on every connection. Encrypted at rest.
Hosting: United States, under a Business Associate Agreement.
Access: Named accounts. Each physician sees only their own patients and notes. Sessions expire and can be revoked.
Audit: Every sign-in and every record opened, edited, signed, exported or filed is written to a time-stamped audit trail.
Data: Dictation audio is deleted once transcribed. Note text never enters application logs. Patient data is never used to train models.
Integrity: Signed notes are locked. Later changes are dated addenda. Nothing is billed automatically.
Partners: Every technology partner that handles protected health information is under a Business Associate Agreement.
Compliance: HIPAA and HITECH. SOC 2 controls. The agreements and the partner list are provided to enterprises on request.
Disclosure: Security issues are reported under the enterprise agreement, without patient information.

Controls