End-to-end data protection you can count on.
Protection applied across every layer of the data lifecycle — built to the standards your security and compliance teams require, and backed by real-world healthcare engineering experience.
The one paragraph to send your CISO
Medically is a HIPAA-compliant platform. All customer data resides in the United States and is encrypted in transit and at rest. The AI runs under enterprise agreements, so your PHI is never used to train AI models. A Business Associate Agreement (BAA) is available on request. A SOC 2 Type II audit is on our roadmap.
Protection at every layer of the data lifecycle.
End-to-end data protection
- Protection applied across every layer of the data lifecycle
- All PHI encrypted in transit and at rest
- TLS 1.2/1.3 for data in motion
- AES-256 encryption for data at rest
- Fully aligned with HIPAA security requirements
Compliance, controls & governance
- HIPAA and HITECH compliant platform controls
- Security practices modeled on the SOC 2 Trust Services Criteria (Type II audit planned — on our roadmap)
- Cryptography aligned with FIPS 140-2 standards
- AI runs under enterprise agreements — your data is never used to train models
- Governed by proven security frameworks and best practices
Exactly what happens to your charts — and why they stay private.
When Medically reads a chart for CDI and coding, your PHI is protected at every step: accessed read-only, minimized before processing, isolated to your organization, never used to train AI, and never sold, exposed, or re-identified.
Read-only connection to your EMR
- Connects to your EHR through a least-privilege, read-only integration
- Medically never writes to, edits, or deletes anything in your source system
- Only the minimum data needed for the task is accessed (minimum-necessary)
- Every connection is authenticated and encrypted end to end (TLS 1.2/1.3)
PHI minimized before processing
- Charts are used only for the specific CDI and coding task you requested
- Direct identifiers are minimized or masked before AI analysis wherever the task allows
- No secondary use — your data is never repurposed, profiled, or mined
- Processing is transient: PHI is not retained by the AI layer beyond the request
Isolated to you, never used to train AI
- Each organization's data is logically isolated — never commingled with other clinics
- AI runs under enterprise agreements that prohibit training models on your data
- No model "learns" from your patients — outputs are generated, never memorized
- Encrypted in transit and at rest at every step (TLS 1.2/1.3, AES-256)
No identity exposure or re-identification
- Strict least-privilege access — Medically personnel cannot browse your PHI
- Every access to PHI is uniquely authenticated and fully audit-logged
- Safeguards against re-identification of minimized or de-identified data
- Your data is never sold or shared, and is never exposed to other customers
Hardened, U.S.-resident, and operated by people who've done this for decades.
Data residency & regulatory alignment
- All data stored exclusively within the United States
- Supports regulatory compliance and jurisdictional requirements
- Designed to provide confidence and peace of mind for healthcare providers
Security leadership & engineering experience
- Backed by 22+ years of IT and cloud architecture experience
- Built and maintained by certified AWS architects and engineers
- Deep expertise in healthcare security and compliance
- Security decisions driven by real-world operational experience
Full control over clinical data
- Your organization retains full ownership and control of all data
- Secure handling of charts, findings, queries, appeals, and the audit ledger
- Configurable retention and manual deletion options
- Data managed under strict access and lifecycle controls
Built for reliability & trust
- Hardened AWS infrastructure with high availability
- Proactive monitoring and security validation practices
- Engineered for uninterrupted access and scalability
- Designed to meet the reliability expectations of healthcare organizations
Every HIPAA safeguard, implemented.
Medically meets the Administrative, Physical, and Technical safeguards of the HIPAA Security Rule (45 CFR §164.308–.312), along with the Privacy Rule and Breach Notification Rule. Below is exactly what we have in place.
Administrative safeguards §164.308
- Security management process — risk analysis, risk management, and information-system activity review
- A designated Security Official accountable for the program
- Workforce security — authorization, clearance, and termination procedures
- Information-access management on a minimum-necessary basis
- Ongoing security awareness training for all workforce members
- Security incident response and reporting procedures
- Contingency plan — data backup, disaster recovery, and emergency-mode operation, with periodic testing
- Periodic evaluation of safeguards, and Business Associate Agreements with all partners
Physical safeguards §164.310
- Hosted on AWS, whose data centers maintain SOC 2 and ISO 27001 attestations
- Workstation use and security policies for all workforce devices
- Full-disk encryption and endpoint protection on managed devices
- Device and media controls — secure disposal, re-use, and accountability
- Encrypted, access-controlled data backup and storage
Technical safeguards §164.312
- Access control — unique user IDs, role-based access, automatic logoff, and emergency access
- Encryption of ePHI in transit (TLS 1.2/1.3) and at rest (AES-256)
- Audit controls — comprehensive logging of access to and activity on ePHI
- Integrity controls protecting ePHI from improper alteration or destruction
- Person/entity authentication, including multi-factor authentication
- Transmission security — integrity checks and end-to-end encryption
What an auditor gets when they ask "why this code?"
Security is only half of what a compliance team needs from an AI vendor. The other half is being able to reproduce every decision the system was part of.
Append-only audit ledger
- Every finding records its evidence, the payer criteria version applied, the defensibility score breakdown, and the model and prompt versions that produced it
- Accept, reject, and query each carry a required reason code, the reviewer, and a timestamp
- Events are appended, never overwritten or deleted
Permission-gated exports
- An OIG-ready audit export carries evidence, criteria, score arithmetic, disposition, reason codes, and model IDs in one file
- Because the export contains verbatim chart text, access is role-restricted and every export is itself logged
- Precision and acceptance rates by finding type are available in the compliance console at any time
Versioned, monitored models
- New finding types run in shadow mode — scored and logged, not shown — before they are turned on
- Bias and drift monitoring by finding type, payer, and service line
- Model documentation available to customers under NDA; independent validation on your own charts welcome
Working toward all five Trust Services Criteria.
We use the AICPA SOC 2 Trust Services Criteria — Security, Availability, Processing Integrity, Confidentiality, and Privacy — as the framework for our security program. A SOC 2 Type II audit is on our roadmap; we'll post the report here once it's complete.
Security
The common-criteria baseline: systems are protected against unauthorized access, disclosure, and damage.
Availability
High-availability AWS infrastructure with monitoring, redundancy, and tested recovery to meet uptime commitments.
Processing integrity
Processing is complete, valid, accurate, and timely — every output traceable to its source evidence.
Confidentiality
Confidential data is classified, encrypted, and access-restricted across its full lifecycle.
Privacy
Personal information is collected, used, retained, and disposed of in line with our privacy commitments.
Common Criteria (CC1–CC9) we are building toward
Have your security team take a look.
We're happy to walk through our architecture, controls, and compliance posture in detail — or send you a Business Associate Agreement to review with your compliance team.
Have questions first? Contact us →