# HIPAA and Security Demo Video: Encryption, BAA, No Training > Watch a narrated demo of how Medrecords AI protects case records: encryption, a BAA on record, 4 vendors, breach notice, exit terms, never used to train AI. Canonical page: https://medrecords.ai/videos/security/ --- [Home](https://medrecords.ai/) › [Demo videos](https://medrecords.ai/videos/) › [Security and HIPAA](https://medrecords.ai/security/) ## Watch how Medrecords AI protects case records Medrecords AI encrypts records in transit with TLS 1.2 or better and at rest with AES-256, keeps the BAA you accept at sign-up on record, and never uses your records to train any AI model. Only 4 vendors can touch your records, all under a BAA, and people see only the cases assigned to them. It is HIPAA compliant and SOC 2. This narrated demo shows each safeguard on an invented case. By [Ahmed Jemaa](https://medrecords.ai/authors/ahmed-jemaa/), Co-Founder & CEO of Medrecords AI · Published 3 Nov 2026 · Updated 4 Nov 2026 Your browser cannot play this video. [Download the MP4 (82 seconds)](https://medrecords.ai/assets/feature-videos/security-16x9.mp4?v=20261104n). 82 seconds, with voiceover. The numbered list below follows the video, and the transcript is the narration. ### What the video shows 1. **Encrypted in transit and at rest.** Rivera_records_4821.pdf, 212 pages, crosses from the browser to Medrecords AI over TLS 1.2 or better and lands in storage encrypted with AES-256. 2. **The BAA is on record.** Settings, Legal lists the Terms of Service, the Privacy Notice and the Business Associate Agreement, each accepted. The BAA row opens to who accepted version 1.0, when, the method and the SHA-256 hash of the text, with a button to export the certificate. 3. **Never used for training.** Records go into your case for the chronology, summaries, ledger and reports. Training any AI model is struck through and stamped Never. 4. **4 vendors, all under a BAA.** AWS stores files in US data centers. OpenRouter routes AI requests. Anthropic and OpenAI are backup models, reached only through OpenRouter. 5. **Only assigned people see a case.** Your team and Medrecords AI staff see only the cases assigned to them, support access needs your approval, and every access is logged with who, what and when. 6. **Breach notice and the way out.** If a breach happens, we notify you no later than 72 hours after we confirm it. When you leave, you get a 30-day export window, then your records are destroyed, backups included, with a deletion certificate. 7. **HIPAA compliant and SOC 2.** 4 tiles get their checks: HIPAA compliant and SOC 2, each with a readiness report free to download, a BAA and DPA available before you upload, and a PHI audit log where every access to a case is logged. ### Why the BAA keeps its hash When a client or carrier asks whether a BAA was in place, "we clicked accept" is a weak answer. The record shows which version was accepted, by whom, when and how, plus a hash of the exact text, and it exports as a certificate. Encryption and the no-training rule cover the records themselves; the BAA record covers the paperwork. ### Transcript 1. Your records stay encrypted, logged and yours. 2. Every file is encrypted in transit with TLS 1.2 or better, and in storage with AES-256. 3. A business associate agreement, or BAA, is the contract HIPAA requires. You accept it at sign-up. The version, the time and a fingerprint of the text stay on record. 4. Your records are used for your case. They never train an AI model. That's in the contract. 5. Only 4 vendors can touch your records. AWS stores them in the US. OpenRouter routes AI requests, with Anthropic and OpenAI as backup models. All 4 sign a BAA. 6. People see only the cases assigned to them. Our staff too, and support access needs your approval. Every access is logged. 7. If a breach happens, we notify you no later than 72 hours after we confirm it. When you leave, you get 30 days to export. Then your records are destroyed, backups included, with a deletion certificate. 8. Readiness reports for HIPAA and SOC 2 are free to download on our security page. No form, no NDA. 9. Medrecords AI is HIPAA compliant and SOC 2. BAA and DPA available. Every name, provider and date in the demo is invented. No real patient data appears in the video. [Book a demo](https://medrecords.ai/demo/) [Read about security and HIPAA](https://medrecords.ai/security/) [See a HIPAA vendor intake checklist](https://medrecords.ai/content-hub/samples/hipaa-vendor-intake-checklist/) ### Also watch - [The billing ledger, every charge tied to its bill](https://medrecords.ai/videos/billing-ledger/) (35 seconds) - [From a pile of records to a cited chronology](https://medrecords.ai/videos/chronology/) (20 seconds) [All demo videos](https://medrecords.ai/videos/) Last verified: 2026-11-04