Notermed

Security & compliance

Security & HIPAA

How Notermed protects patient health information, stated specifically so that your compliance team can verify every claim.
Protections on every plan
  • BAA with every clinicSigned before any patient data is processed
  • United States onlyHosted on AWS in US regions, end to end
  • Encrypted throughoutTLS in transit, AES-256 at rest
  • Every access auditedUser, action, record, time and IP
  • Three named subprocessorsEach under its own BAA
  • Never used to train AIOurs or anyone else’s

Questions doctors ask first

7 questions
Will you sign a BAA with my practice?
Yes. Every clinic signs a Business Associate Agreement with us electronically during onboarding, before any patient data is processed. Without a signed BAA, no patient data is processed.
Where do my patients' recordings go?
To Amazon Web Services in US regions, where the note is drafted and stored. Transcription runs in the United States at one of three named vendors, each under a BAA. Patient data is not processed or stored outside the United States at any stage.
Do you train AI on my patients' data?
No. Recordings, transcripts and notes are never used to train AI models, ours or anyone else's, and no data is ever sent to ChatGPT, OpenAI or any vendor without a BAA.
What do I need to do on my side?
Sign the BAA during onboarding, and document patient consent before you record a visit. We provide a patient consent form template for that.
Can Notermed staff read my notes?
Notermed's system administrators can open a clinic's records, which is how we resolve support requests. Every access to patient data, theirs included, writes an audit record naming the user, the action, the record and the time, and your clinic can request that register.
How long do you keep the visit recordings?
Until your clinic deletes them. A recording stays with its visit, encrypted, until you delete the visit or the patient, which removes the audio, transcript and notes together, or until you ask us to return or destroy your clinic's data. A recording never filed to a patient is deleted automatically after five days.
What happens to our data if we leave?
You can delete sessions and patients at any time, and at termination you can ask us to return or destroy all of your clinic's data.

Our approach: claim only what we can prove

Your patients' recordings never leave the United States, and are never used to train AI.

Notermed creates, receives, and stores Protected Health Information (PHI) on behalf of the clinics we serve, which makes us a Business Associate under HIPAA. Everything on this page is either visible in our infrastructure, written into our agreements, or demonstrable in the product, and we will walk your compliance reviewer through any of it.

You will not find certification badges here that we have not earned. What you will find is a specific, checkable description of how your patients' data is handled.

Safeguards in place today

16 controls

Grouped by category, so each control can be checked.

  1. Technical safeguards

    • TLS encryption for all data in transit
    • AES-256 encryption at rest for recordings, transcripts, notes, and the database
    • Role-based access control, isolated per clinic
    • Account lockout after repeated failed sign-ins
    • Two-factor authentication for administrator accounts
    • Biometric app lock (Face ID / fingerprint) on mobile

  2. Auditability

    • Every access to patient data writes an audit record
    • Audit trail captures user, action, record, timestamp, and IP
    • Audit records contain no patient data themselves
    • Electronic agreement signatures recorded with content fingerprint
    • Registers available to your clinic on request

  3. Infrastructure

    • Hosted entirely on Amazon Web Services in US regions
    • Business Associate Addendum executed with AWS
    • Note generation via AWS Bedrock, inside our AWS environment
    • Transcription runs at one of three vendors, each under a BAA (listed below)
    • No data ever sent to ChatGPT, OpenAI, or any vendor without a BAA

Where your data lives, start to finish

One visit, start to finish

All within the United States

  1. Step 1Recorded with consentDocumented patient consent before any recorded encounter
  2. Step 2Encrypted in transitTLS from the exam room to our servers
  3. Step 3Transcribed in the USBy one of three vendors, each under a BAA
  4. Step 4Note draftedAWS Bedrock, inside our AWS environment
  5. Step 5Stored and auditedAES-256 at rest, every access logged

  • Breach notification

    Our clinic agreement commits us to reporting any impermissible use or disclosure of PHI to your clinic without unreasonable delay, and no later than 15 days after discovery.

  • Deletion and return of data

    Clinics can delete sessions and patients, and can request return or destruction of all their data at termination.

  • Consent-first recording

    We provide clinics with a patient consent form template, and our agreement requires documented patient consent before any recorded encounter.

Subprocessors

3 companies

Every company that can process patient data on our behalf, what it receives, and the agreement it operates under. Current as of September 13, 2026.

  • Amazon Web Services

    Hosting, storage, database, and note generation (Amazon Bedrock). Also one of the three transcription options (Amazon Transcribe and Transcribe Medical).

    Receives
    Recordings, transcripts, notes, patient records
    Agreement
    Business Associate Addendum

  • AssemblyAI

    Speech-to-text transcription, when a clinic is configured to use it.

    Receives
    Visit audio and the resulting transcript
    Agreement
    Business Associate Agreement

  • Deepgram

    Speech-to-text transcription, when a clinic is configured to use it.

    Receives
    Visit audio and the resulting transcript
    Agreement
    Business Associate Agreement

  • Which one transcribes your visits

    Transcription is a per-clinic setting, so your clinic uses one of the three. We will tell you which on request, and the server records the vendor that received each individual recording. When a recording fails at one vendor and is retried at another, both are recorded, because a breach notice would have to name both.

  • Adding a subprocessor

    No company is added to this list before its Business Associate Agreement is executed. We notify clinics in advance of adding a subprocessor that would process patient data, and this page carries the date it last changed.

  • Services that receive no patient data

    The Clinical Evidence feature searches PubMed, which is run by the US National Library of Medicine. The note itself never leaves our AWS environment: it is reduced there to a generic clinical term of one to three words, such as “asthma exacerbation”, and only that term is sent to PubMed. No patient identifiers, no note text, and no transcript. PubMed is therefore not a Business Associate and is not listed above.

    Our payment processor, Stripe, receives your clinic name and billing contact for subscription billing. It receives no patient data of any kind.

Business Associate Agreement

Every clinic signs a Business Associate Agreement with us before any patient data is processed. The signature is part of onboarding, completed electronically, and your clinic keeps a copy of the signed record. Without a signed BAA, no PHI is processed.

Request the BAA textEmail our compliance team