Security and Compliance Posture
EchoMed is built around PHI avoidance and standard security controls — encryption in transit and at rest, two-factor authentication, audit logging, and marketing-pixel suppression on authenticated pages. Every plan includes a Business Associate Agreement, and a subprocessor register is documented. Clinical-content delivery paths are disabled by default, and we continue to mature our compliance program before enabling PHI workflows.
Business Associate Agreement
A Business Associate Agreement is included at every tier. Upstream vendor BAAs/DPAs are tracked in the subprocessor register and reviewed before PHI workflows are enabled.
No Persistent Clinical Content
Dictation audio, transcripts, and generated notes are processed in-session and are not stored on our servers by default. Usage counters and audit events record metadata only.
BAA-Covered AI Processing
AI and speech processing are routed through Azure services intended to be covered by Microsoft DPA/BAA terms. Production PHI should not be routed to non-BAA model providers.
Two-Factor Authentication
Optional 2FA via authenticator apps with recovery codes. Email verification required for all accounts. Passwords hashed with scrypt; rate limiting applied to authentication and AI endpoints.
Append-Only Audit Log
Authentication, generation, transcription, PHI acknowledgments, and account changes are logged to an append-only audit table. Audit events record metadata only; no clinical content is captured.
Transport and At-Rest Encryption
TLS for requests and responses. Database encryption at rest via the managed Postgres provider. Vendors are tracked by data category, agreement status, and PHI exposure.
For Agencies, Practices, and Organizations
Evaluating EchoMed for a clinical team? We provide a compliance-review package on request:
- Business Associate Agreement
- Security questionnaire responses
- Risk assessment documentation
- Security and privacy policy documentation
How we protect clinical workflows
For organizational deployments, EchoMed's goal is to process clinical documentation through approved, BAA-backed paths instead of relying on PHI avoidance alone. Users can still minimize identifiers in dictation, but compliance depends on the full control set:
- Customer BAA workflow - Organization deployments require a signed BAA before production PHI is allowed.
- Vendor review - Subprocessors are tracked with agreement status, PHI exposure, and required actions.
- Identifier detection before generation - If potential identifiers are detected, a blocking modal requires explicit acknowledgment before proceeding. Overrides are logged.
- Output scanning after generation - Generated notes are scanned and flagged if potential identifiers appear, so users can review before clinical use.
- Review gate before export - Copy and download actions are disabled until the user confirms review. Email and secure-link sharing are disabled by default.
Minimum-Necessary Dictation
Keep patient identifiers out of your dictation. In particular, avoid:
- Patient names - Use "patient" or "pt" instead
- Dates of birth / specific ages - Use age ranges if clinically relevant ("elderly", "in their 70s", "pediatric")
- Medical record numbers (MRN) - Not needed for dictation
- Phone numbers, emails, or addresses - Not needed for clinical notes
- Social Security Numbers - Never needed for dictation
- Insurance / member IDs - Add after note is generated
- Specific facility or practice names - Use generic terms
- Clinician names tied to a patient - Use role ("PCP", "cardiologist")
Technical details
Data handling
- Audio and notes are processed in-session to generate output.
- Visit content is processed in-session and not stored on the server.
- Usage counters record minutes and note counts only.
- Audit events record metadata only (note format, discipline, timing). No clinical content is stored.
Operational controls
- Transport encryption (TLS) for all requests and responses.
- Secure session cookies (HttpOnly, SameSite).
- Weekly and daily compliance acknowledgments required before dictating.
- Vendor coverage tracked in the subprocessor register before PHI workflows are enabled.