Security review before patient-data use

The public pilot is limited to synthetic or role-played scenarios. Before any patient-data workflow, confirm current technical controls, model data flow, access boundaries, retention, BAA requirements, and implementation responsibilities directly with AIDoctorNotes.

This page describes the security approach. It is not a substitute for a formal BAA, vendor review, or your own compliance signoff before live PHI use.

What the architecture actually does

• Encryption in transit — all audio and text data is transmitted over TLS 1.2+ between the client, application servers, and any subprocessor, with no fallback to unencrypted connections.
• Encryption at rest — PHI stored in the database and object storage is encrypted using AES-256, with keys managed by the underlying cloud provider's KMS service.
• Role-based access control — access to production data is gated by least-privilege role assignment, with audited access paths and revocation at offboarding.
• Audit logging — authentication events, PHI access, and administrative actions are logged and reviewed when investigating incidents.
• No PHI in third-party model training — audio and transcribed text are not retained for training of any AI/LLM model, ours or any subprocessor's.
• Ephemeral processing pipeline — audio is processed and discarded after transcription completes; the persistent record is the structured note, not the raw audio, unless you opt in to retain it.

HIPAA posture and what we do not claim

The public pilot is limited to synthetic or role-played scenarios — do not submit PHI. BAA, security, privacy, retention, subprocessor, and implementation requirements must be separately reviewed and confirmed in writing before any patient-data workflow. Drafts require professional review; generation does not approve, file, or authorize clinical use.

HIPAA itself is a regulation, not a certification. We do not claim SOC 2 Type II, HITRUST CSF, ISO 27001, FedRAMP authorization, or published independent penetration test reports. We name the gaps so a prospective customer can make an informed decision.

Subprocessors, incidents, and retention

Before any live implementation, configured providers and required data flows must be disclosed and approved — categories may include cloud infrastructure, speech-to-text transcription, a configured large language model provider, transactional email, and logging or monitoring. No patient-data processing relationship is created by public-pilot access.

Vulnerabilities discovered by external researchers are welcomed at security@aidoctornotes.com — do not include patient information in a report. Audio, draft, note, backup, deletion, export, and legal-hold requirements must be agreed in writing before patient-data use.