Security and HIPAA
What a vendor needs before a security review, stated precisely. A signed BAA on every plan, AES-256 in transit and at rest, encounter audio deleted within 24 hours with an audit trail, and no PHI in analytics or logs at all.
How Clinical Data Is Handled
Ambient documentation means a recording of a patient encounter exists, however briefly. The questions that follow are the right ones to ask, and they deserve specific answers rather than a compliance badge.
Audio is deleted within 24 hours
Every recording carries a retention deadline set at upload, and a scheduled sweep removes expired audio from storage and records the deletion in an audit trail. Retention is a bound the system enforces, not a policy someone remembers to apply.
A signed BAA on every plan
The Business Associate Agreement is included at no additional cost on every plan, including during the free trial. It is a HIPAA requirement rather than a premium feature, and charging separately for one should be treated as a warning sign in any vendor.
AES-256, in transit and at rest
Audio, transcripts and finished notes are encrypted in transit and at rest. Access to clinical data is scoped per organisation and enforced in the database rather than only in application code.
Recordings are not used to train models
Encounter audio and transcripts are not fed back into model training. This is the question practices ask most often once they understand what ambient documentation involves, and the answer should be unambiguous.
PHI Never Enters Telemetry
The quiet way clinical text escapes a product is not a breach. It is an analytics event with a helpful free-text field, shipped to a third party by a developer who meant well. That is a design problem, so it is solved by design.
No PHI in analytics or logs
Product analytics and error reporting carry opaque identifiers and enumerated metadata only. No transcripts, no note content, no patient names, no free-text fields. This is a platform-level rule with guard tests rather than a convention people follow carefully.
One chokepoint, not many judgement calls
Events pass a single guard before leaving the product, so the rule is enforced in one reviewable place instead of relying on every future feature getting it right independently.
What this means for you
A partner integrating VoiceboxMD is not inheriting a telemetry pipeline full of clinical text. If your own review asks where PHI could leak into third-party analytics, the answer is that it does not enter the pipeline in the first place.
The Short Version for Your Reviewer
The questions a healthcare security review asks first, with the answers, so nobody has to schedule a call to establish the basics.
| Question | Answer |
|---|---|
| Is a BAA available and included? | Yes, on every plan at no extra cost, including the trial |
| How long is audio retained? | Deleted within 24 hours of upload, enforced by a scheduled sweep |
| Is deletion auditable? | Yes, deletions are recorded in an audit trail |
| Is data encrypted at rest? | Yes, AES-256, in transit and at rest |
| Are recordings used for training? | No |
| Does PHI reach analytics or logs? | No, opaque identifiers and enumerated metadata only |
| Is clinical data scoped per practice? | Yes, enforced in the database, not only in app code |
Questions this page does not answer, including subprocessors and contractual terms, are answered by a person rather than approximated here. Ask below.
Ask Us Something Specific
Security questions get a direct answer from someone who knows the system, not a brochure. If there is a blocker, we would both rather find it now.
Security and HIPAA, Frequently Asked Questions
How long does VoiceboxMD keep the audio?
Recordings are deleted within 24 hours. Each file is given a retention deadline when it is uploaded, a scheduled job removes anything past its deadline from storage, and the deletion is written to an audit trail. The design intent is that the audio exists only long enough to produce the note, so the durable artifact is the note rather than a recording of the patient.
Is the BAA included or does it cost extra?
Included on every plan at no additional cost, including during the 7-day free trial. A Business Associate Agreement is a HIPAA requirement for any vendor handling PHI on a covered entity’s behalf, not an upgrade, and vendors who charge separately for one are worth questioning.
Are encounter recordings used to train your models?
No. Encounter audio and transcripts are not used for model training. This tends to be the question that decides whether a practice adopts ambient documentation at all, so it is worth stating plainly rather than burying in terms.
Could PHI reach your analytics or error tracking?
No. Analytics and error reporting carry opaque identifiers and enumerated metadata only, with no transcripts, note content, patient names or free-text fields, and events pass a single guard before leaving the product. Enforcing it at one chokepoint rather than per feature is what makes the rule hold as the product grows.
How is one practice’s data kept separate from another’s?
Access to clinical data is scoped by organisation and enforced in the database itself, so a query that should not cross a practice boundary cannot, regardless of what application code asks for. Enforcing isolation only in application code means every future endpoint has to get it right; enforcing it in the database means it holds by default.
What happens to PHI once we integrate?
An integration changes where the finished note is delivered, not how the encounter is handled. Audio retention, encryption, tenant isolation and the telemetry rules are unchanged. What does need agreeing is the BAA chain, because a vendor delivering VoiceboxMD to their own customers sits between us and the covered entity, and that relationship should be papered before any technical work starts.
Can we get more detail for a formal security review?
Yes. This page covers what can be stated publicly and precisely. Questions about subprocessors, deployment specifics or contractual terms are answered directly by a person rather than approximated on a marketing page, and we would rather have that conversation early than discover a blocker after engineering has started.
The audio is gone in 24 hours.
BAA on every plan, no PHI in telemetry, isolation enforced in the database.
Start a security review