HIPAA and BAA
We sign a BAA. Patient data is handled under that agreement. US data residency.
For IT contacts and reviewers
Security and data handling.
What we do, stated specifically — because specifics are checkable and adjectives are not.
No PHI used for model training
Practice data is not used to train foundation models.
Identity verification before chart-specific actions
At least two matching factors before any chart read — name plus date of birth, then a callback number or MRN. A surname alone is refused as an enumeration attempt. Third-party, pharmacy, and other-office callers are refused chart access at the tool boundary.
Human approval for sensitive actions
Nothing patient-facing publishes without a release by a named person, bound to the exact content approved. If the content changes after approval, the publish is refused and the refusal is logged.
Encryption in transit
Control-plane API and staff portal traffic use HTTPS.
Tool permissions and access limits
The assistant can only use the tools the practice has granted. A request for a tool it does not hold is denied, and the denial is recorded.
Audit logs
Every tool call and state change is written to a tamper-evident log. Verification recomputes the record.
Tenant separation
Practice scope is carried in the access token. Out-of-scope requests return not-found.
EMR integration controls
Writes follow the sanctioned path for that practice. An unsupported action is refused rather than guessed, and staff are notified.
Breach contact
Write hello@docassistants.com with the subject line “Security review”. Do not send PHI in that first note.
Security questions.
Write hello@docassistants.com with the subject line “Security review”.