Is Medrecords AI HIPAA compliant, and who can see my cases?
Yes. Medrecords AI is HIPAA compliant and runs under SOC 2 controls. You accept our Business Associate Agreement when you sign up. Only you can open the cases you create. Your records are stored in the United States, on Amazon Web Services, and they are never used to train AI models.
Help center contents26 articles
Start here
Work with the records
Write and share
Account and trust
Case type playbooks
Who can open your cases
| Who | What they can do |
|---|---|
| You, the case owner | Open, change, export and delete the case |
| Other users, including people at your firm | Nothing. They cannot see the case |
| Medrecords AI staff | Read a case only when needed for support. They cannot change it, and each time they open a case it is logged |
Each case has 1 owner. There is no case sharing or team seat today. If a colleague needs the work, export the chronology or report and send them the file. See export your work.
Each person needs their own account. Do not share a login, even inside your firm. HIPAA expects each user to have their own sign-in, so the record of who did what stays true.
The Business Associate Agreement
- The BAA is shown at sign-up, with the Terms and the Privacy Notice. You accept all 3 before you can upload.
- The app records which version you accepted and when.
- If your firm needs a countersigned copy, ask for one on our HIPAA and BAA page.
Many personal injury firms and insurers are not covered by HIPAA. You get the same protections under the BAA and our terms either way.
Where your records are stored
Your files and case data are stored on Amazon Web Services in the United States. The list of companies that can process records for us is on our subprocessor list. Each one that can touch patient data signs a BAA with us. None of them may train on your records.
Signing in
- Your session is held in a secure browser cookie.
- If you change or reset your password, every open session is signed out.
- Signing out ends the session on that device.
Deleting your data
- Open the case list.
- Select the case, or up to 50 cases at once.
- Delete them.
Deleting a case removes its files, its data and its search entries. A case that is still processing is skipped, so wait until it finishes.
When an account closes, our terms say we return or destroy the data within 30 days. Encrypted backups are kept for up to 90 days and then removed.
Keep patient details out of chat and email
The help chat in the app asks you to leave patient names and details out. Do the same when you email us. Keep records inside the app, where they are protected.
What Medrecords AI does not do
- It does not make clinical or legal decisions. Its output organizes and cites your records. You and your experts draw the conclusions.
- It does not vouch for the source records. If a record is wrong, the summary of it will be too.
Related help
- Fix a failed upload or a stuck case
- How accurate is Medrecords AI?
- Export your work
- Read our security and trust page and the guide to HIPAA compliant AI record review.
Facts checked against the Medrecords AI app code on 2026-10-24.