Subprocessor Register

Microsoft Azure

Services: Azure App Service, Azure OpenAI Service, Azure Speech Services

Application hosting, speech-to-text, and AI note generation.

PHI exposure: May create, receive, maintain, or transmit ePHI during transcription and note generation when users include PHI.

Stores clinical content at rest: False

Evidence on file: compliance/Microsoft_Products_and_Services_DPA_September_2025.pdf

Required Actions

• Keep production AI and STT traffic on Azure services covered by Microsoft DPA/BAA terms.
• Use region/geography settings approved for the customer population.
• Avoid preview, global, or stateful AI features until reviewed for HIPAA impact.
• Revisit abuse-monitoring review options as Azure account status changes.

Neon

Services: PostgreSQL

Managed database for user accounts, usage counters, audit metadata, subscription metadata, preferences, templates, and short-lived encrypted secure notes if secure links are enabled.

PHI exposure: May maintain ePHI only if secure links or future persistent clinical storage are enabled.

Stores clinical content at rest: Only for encrypted short-lived secure-note records when ENABLE_SECURE_NOTE_LINKS is enabled.

Evidence on file: compliance/baa-neon.pdf

Required Actions

• Verify the production project is on the Neon plan covered by the signed BAA.
• Keep database SSL required.
• Do not add persistent clinical-note storage until retention, encryption, and org policy controls are implemented.

Cloudflare

Services: DNS, CDN, WAF, DDoS protection

Edge routing, DNS, TLS termination, caching, and traffic protection.

PHI exposure: May transmit ePHI if authenticated PHI routes are proxied through Cloudflare.

Stores clinical content at rest: False

Evidence on file: compliance/Cloudflare DPA.pdf

Required Actions

• Either execute a Cloudflare Enterprise BAA or bypass Cloudflare proxying for PHI routes.
• Disable caching for authenticated and API routes.
• Document TLS mode and origin certificate configuration.

Resend

Services: Transactional email

Email verification, password reset, support/feedback notifications, and secure-link delivery when enabled.

PHI exposure: May transmit ePHI risk if emails contain note content or bearer URLs that grant access to note content.

Stores clinical content at rest: False

Evidence on file: compliance/Resend_Data_Processing_Addendum.pdf

Required Actions

• Do not send note content through Resend.
• Keep ENABLE_SECURE_NOTE_LINKS disabled until a BAA-covered email/link delivery design is approved.
• Use Resend only for non-PHI account and support email unless BAA coverage is confirmed.

Stripe

Services: Payments, Billing portal, Webhooks

Subscription billing and payment processing.

PHI exposure: No clinical content should be sent to Stripe.

Stores clinical content at rest: False

Evidence on file: compliance/Stripe DPA.pdf

Required Actions

• Do not put patient identifiers or clinical details in Stripe customer names, metadata, descriptions, or invoices.
• Keep webhook payload logging sanitized.

OpenAI API

Services: Direct OpenAI API

Optional future AI provider fallback; not approved for production PHI unless a BAA is executed directly with OpenAI.

PHI exposure: Would create, receive, maintain, or transmit ePHI if used for clinical generation.

Stores clinical content at rest: False

Required Actions

• Do not route production PHI to direct OpenAI APIs until a BAA is executed and filed.
• Keep provider configuration fail-closed for HIPAA mode.
• If direct OpenAI is enabled later, update this register and the compliance pack.

GitHub / GitHub Container Registry

Services: Source control, Container registry

Code hosting and deployment artifact storage.

PHI exposure: No PHI should be stored or logged in source control or container images.

Stores clinical content at rest: False

Required Actions

• Do not commit PHI, secrets, logs, database dumps, transcripts, notes, or customer files.
• Use secret scanning and branch protection for production branches.