Home › Demo videos › Security and HIPAA

What the video shows

1. Encrypted in transit and at rest. Rivera_records_4821.pdf, 212 pages, crosses from the browser to Medrecords AI over TLS 1.2 or better and lands in storage encrypted with AES-256.
2. The BAA is on record. Settings, Legal lists the Terms of Service, the Privacy Notice and the Business Associate Agreement, each accepted. The BAA row opens to who accepted version 1.0, when, the method and the SHA-256 hash of the text, with a button to export the certificate.
3. Never used for training. Records go into your case for the chronology, summaries, ledger and reports. Training any AI model is struck through and stamped Never.
4. 4 vendors, all under a BAA. AWS stores files in US data centers. OpenRouter routes AI requests. Anthropic and OpenAI are backup models, reached only through OpenRouter.
5. Only assigned people see a case. Your team and Medrecords AI staff see only the cases assigned to them, support access needs your approval, and every access is logged with who, what and when.
6. Breach notice and the way out. If a breach happens, we notify you no later than 72 hours after we confirm it. When you leave, you get a 30-day export window, then your records are destroyed, backups included, with a deletion certificate.
7. HIPAA compliant and SOC 2. 4 tiles get their checks: HIPAA compliant and SOC 2, each with a readiness report free to download, a BAA and DPA available before you upload, and a PHI audit log where every access to a case is logged.

Why the BAA keeps its hash

When a client or carrier asks whether a BAA was in place, "we clicked accept" is a weak answer. The record shows which version was accepted, by whom, when and how, plus a hash of the exact text, and it exports as a certificate. Encryption and the no-training rule cover the records themselves; the BAA record covers the paperwork.

Transcript

1. Your records stay encrypted, logged and yours.
2. Every file is encrypted in transit with TLS 1.2 or better, and in storage with AES-256.
3. A business associate agreement, or BAA, is the contract HIPAA requires. You accept it at sign-up. The version, the time and a fingerprint of the text stay on record.
4. Your records are used for your case. They never train an AI model. That's in the contract.
5. Only 4 vendors can touch your records. AWS stores them in the US. OpenRouter routes AI requests, with Anthropic and OpenAI as backup models. All 4 sign a BAA.
6. People see only the cases assigned to them. Our staff too, and support access needs your approval. Every access is logged.
7. If a breach happens, we notify you no later than 72 hours after we confirm it. When you leave, you get 30 days to export. Then your records are destroyed, backups included, with a deletion certificate.
8. Readiness reports for HIPAA and SOC 2 are free to download on our security page. No form, no NDA.
9. Medrecords AI is HIPAA compliant and SOC 2. BAA and DPA available.

Every name, provider and date in the demo is invented. No real patient data appears in the video.

Last verified: 2026-11-04