How we handle patient data
Our automations work with protected health information (PHI): patient names, dates of birth, member IDs and coverage details. This page explains where that data goes, who can access it, and what we sign before we see any of it.
-
Where the automation runs
In your environment, in most cases. Usually that is a virtual machine on your side. If you don't have one, we help you set it up in your own AWS or Azure account.
We prefer that you own the machine, so the data and the automation stay under your control.
-
What we sign
A Business Associate Agreement (BAA), before we see any patient data. We sign it after the intro call and before the discovery call, where you show us your process.
-
Who can access it
Most of our automations run unattended, so nobody needs to sign in to the machine while they work. The only person who signs in is the developer who builds and maintains the automation.
If the machine is yours, you decide who else gets access. If someone on your team needs access, we can set it up.
-
What we store
We process patient data, but we don't store it. The automation reads the data, uses it for the task and writes the result back into your systems.
In rare cases, PHI has to be included in transaction data. When it is, it is encrypted using industry-standard encryption.
-
AI services
When a step needs AI, for example reading a payer response or a document, we use AWS, Microsoft Azure or Google. We have BAAs with AWS and Google. For Azure, Microsoft's BAA is part of its standard licensing terms.
Your data is not used to train their models.
-
Policies and compliance
Our security policies and HIPAA compliance status are on our trust center. You can request any of our policies there.
We are working toward SOC 2.
Have a question about security that isn't answered here? Ask Karl, our CTO, on a call, or write to us.