Security & HIPAA
How Notermed protects patient health information, stated specifically so that your compliance team can verify every claim.
Our approach: claim only what we can prove
Notermed creates, receives, and stores Protected Health Information (PHI) on behalf of the clinics we serve, which makes us a Business Associate under HIPAA. We take that role literally: everything on this page is either visible in our infrastructure, written into our agreements, or demonstrable in the product. We will walk your compliance reviewer through any of it.
You will not find certification badges here that we have not earned. What you will find is a specific, checkable description of how your patients' data is handled.
Safeguards in place today
Grouped by category, so each control can be checked
Technical Safeguards
- •TLS encryption for all data in transit
- •AES-256 encryption at rest for recordings, transcripts, notes, and the database
- •Role-based access control, isolated per clinic
- •Account lockout after repeated failed sign-ins
- •Two-factor authentication for administrator accounts
- •Biometric app lock (Face ID / fingerprint) on mobile
Auditability
- •Every access to patient data writes an audit record
- •Audit trail captures user, action, record, timestamp, and IP
- •Audit records contain no patient data themselves
- •Electronic agreement signatures recorded with content fingerprint
- •Registers available to your clinic on request
Infrastructure
- •Hosted entirely on Amazon Web Services in US regions
- •Business Associate Addendum executed with AWS
- •AI transcription via AWS Transcribe Medical
- •Note generation via AWS Bedrock, inside our AWS environment
- •No data ever sent to ChatGPT, OpenAI, or any vendor without a BAA
Never Used for AI Training
Your patients’ recordings, transcripts, and notes are never used to train AI models, ours or anyone else’s.
BAA With Every Clinic
A Business Associate Agreement is signed electronically during onboarding, before any patient data is processed.
Deletion and Return of Data
Clinics can delete sessions and patients, and can request return or destruction of all their data at termination.
Where your data lives, start to finish
United States only
All PHI is processed and stored in US AWS regions. Patient data does not leave the United States at any stage of the pipeline, whether recording, transcription, note generation, or storage.
One subprocessor, under BAA
Amazon Web Services is our only subprocessor with access to PHI, operating under an executed Business Associate Addendum. There are no other vendors in the patient-data path.
Breach notification
Our clinic agreement commits us to reporting any impermissible use or disclosure of PHI to your clinic without unreasonable delay, and no later than 15 days after discovery.
Consent-first recording
We provide clinics with a patient consent form template, and our agreement requires documented patient consent before any recorded encounter.
Business Associate Agreement
Every clinic signs a Business Associate Agreement with us before any patient data is processed. The signature is part of onboarding, completed electronically, and your clinic keeps a copy of the signed record. Without a signed BAA, no PHI is processed.
Request the BAA textQuestions about compliance?
Ask us anything. If your compliance reviewer wants documentation, we will provide it line by line.
Notermed · CS2 Technologies Inc.
Email: info@notermed.com
Phone: +1 905 749 5338