What HIPAA-compliant actually means for a chatbot
"HIPAA-friendly" and "HIPAA-compliant" get used interchangeably in chatbot marketing, but they're not the same. Compliance has a specific definition:
- Every entity that touches PHI must have a signed BAA
- PHI must be encrypted at rest and in transit
- Access must be logged, with disclosure accounting available on request
- Patients must be able to access, correct, and request deletion of their data
- Breaches must be tracked and reported within 60 days under §164.404
A vendor that ships your patient messages to OpenAI's API has not signed a BAA with OpenAI. They've handed PHI to a non-covered entity. That's a reportable breach, not a feature.
How MyTechGenie's architecture solves this
1. The AI model runs in your cloud
We deploy an open-source language model (Llama, Mistral, or your choice) inside your own AWS or Azure environment. Patient messages are processed locally. No external API call carries PHI.
2. PHI scrubbing on the way out
On the rare occasion the platform needs to call an external service (a weather lookup, a third-party scheduling tool), our PHI scrubber identifies names, dates of birth, MRNs, and other identifiers and replaces them with tokens before the external call. Tokens are de-referenced inside your environment, not by the external service.
3. Field-level encryption, not just "at rest"
Sensitive fields are encrypted individually with AES-256, not just the database around them. A compromised database snapshot doesn't equal compromised PHI.
4. Audit logging on every disclosure
Every access to a patient record is logged with timestamp, requester, purpose, and result. The disclosure accounting export under §164.528 is one click.
5. Tenant isolation by client_id
Multi-tenant by design but strictly isolated. A practice's data is scoped to its tenant identifier in every query. There is no shared knowledge base across practices.
What's in the BAA
Our BAA is straightforward and covers the standard HIPAA Security and Privacy rule obligations:
- Permitted uses and disclosures of PHI
- Safeguards we maintain (administrative, physical, technical)
- Subcontractor requirements (any vendor we use also signs a BAA)
- Breach notification obligations and timelines
- Audit cooperation and inspection rights
- Termination provisions and return/destruction of PHI
Your compliance team can review it before any patient data flows. We're happy to walk through it on a call.
Frequently asked questions
Is the open-source AI model running in our cloud subject to a BAA?
Because the model runs inside your AWS account, the cloud provider's existing BAA covers it. No separate BAA with an AI vendor is required, because no AI vendor is in the data path.
What if we want to use a hosted model like GPT-4 for some queries?
You can — for queries where no PHI is present. The platform's safety gates block hosted-model calls when PHI is detected in the prompt. The decision is automatic and logged.
How do you handle right-to-erasure requests?
The admin tool has a one-click patient deletion that removes the patient's chat history, derived embeddings, and audit-log identifiers. The action itself is logged.
Can we get a copy of the audit log on demand?
The disclosure accounting export under §164.528 is available as CSV or JSON from the admin panel, filterable by date range, patient, and access type.
Is the deployment SOC 2 certified?
SOC 2 Type II is on our roadmap for 2026. We currently operate against SOC 2 controls and can provide our readiness documentation, including the controls inventory and evidence collection process.
Does this work with our EHR system?
We integrate with major EHRs (Epic, Cerner/Oracle Health, athenahealth, eClinicalWorks, Practice Fusion) via HL7 FHIR APIs where available, and via SMART on FHIR for OAuth-protected resources. Specific integration timelines depend on the EHR and your IT team's bandwidth.
Talk to a real human about HIPAA.
A 20-minute call with someone who can walk through the architecture and answer your compliance team's specific questions.
Book a Compliance Call