🔒 HIPAA Compliance Documentation

Built for Healthcare.
Secured for Compliance.

MediCode AI runs entirely on AWS — the only major cloud provider that signs a Business Associate Agreement covering every service we use.

All systems HIPAA-compliant — BAA signed with AWS · Last updated April 2026

Business Associate Agreement

MediCode AI has a signed BAA with Amazon Web Services (AWS), our primary infrastructure provider. The BAA covers every AWS service we use to process, store, and transmit PHI.

Request a BAA Contact Sales
How We Protect PHI
Every layer of MediCode AI is designed with patient data protection in mind.
🔐
Encryption in Transit & at Rest
All data uses TLS 1.3 in transit. AWS RDS Aurora encrypts all data at rest using AWS KMS-managed AES-256 keys. S3 objects use server-side encryption.
🗑️
Zero PHI Retention on Audio
Audio is uploaded to encrypted S3, transcribed by AWS Transcribe, then immediately and permanently deleted. No audio is ever stored long-term.
📋
Full Audit Trail
Every API call is logged with timestamp, user ID, clinic ID, IP address, and action. Audit logs are retained for 6 years per HIPAA requirements.
⏱️
Session Timeout
Dashboard sessions automatically expire after 15 minutes of inactivity. Users receive a 2-minute warning before automatic logout.
🔑
AWS Cognito Authentication
User authentication is handled by AWS Cognito with MFA support, secure token rotation, and short-lived JWT tokens. No passwords stored in our database.
🛡️
Role-Based Access Control
Clinic admins and standard users have distinct permission levels. All database queries enforce clinic-level isolation — no cross-clinic data access is possible.
AWS Infrastructure — All BAA Covered
Every vendor we use has a signed BAA through AWS.
AWS RDS Aurora
PostgreSQL database
✓ BAA covered
AWS Cognito
Authentication & MFA
✓ BAA covered
AWS Transcribe
Audio transcription
✓ BAA covered
AWS Bedrock
AI coding (Claude)
✓ BAA covered
AWS S3
Temporary audio storage
✓ BAA covered
AWS CloudWatch
Logging & monitoring
✓ BAA covered
Technical Safeguards
HIPAA required technical controls we have implemented.

Access Controls

Every user is authenticated via AWS Cognito before accessing any PHI. Tokens expire after 1 hour and rotate automatically. All database queries are scoped to the authenticated clinic — no user can access another clinic's data.

HIPAA Safeguard Checklist
Our implementation status across all HIPAA required safeguards.
SafeguardRequirementStatus
Business Associate AgreementSigned BAA with all vendors handling PHI✓ Active — AWS
Data encryption at restAES-256 or equivalent✓ AWS KMS
Data encryption in transitTLS 1.2 minimum✓ TLS 1.3
Access controlsUnique user IDs, role-based permissions✓ Cognito + RBAC
Audit loggingLog all PHI access with 6-year retention✓ RDS audit table
Automatic session timeoutAuto-logoff after inactivity✓ 15 minutes
PHI minimum necessaryLimit PHI access to what is needed✓ Clinic-scoped queries
Multi-factor authenticationMFA for privileged access✓ AWS Cognito MFA
Audio PHI retentionAudio not stored long-term✓ Deleted after transcription
Contingency planBackup and disaster recovery✓ RDS automated backups
Breach notification procedureNotify HHS and affected individuals✓ Policy in place
Workforce trainingHIPAA training for all staff✓ Completed
Frequently Asked Questions
Common questions from healthcare providers about our compliance.
Is patient audio stored on your servers?
No. Audio is uploaded to an encrypted private AWS S3 bucket solely for transcription, then permanently deleted immediately after AWS Transcribe processes it. No audio is retained after transcription completes.
Which cloud provider do you use and do they sign a BAA?
We run entirely on Amazon Web Services (AWS). AWS signs a Business Associate Agreement covering all HIPAA-eligible services including RDS, Cognito, Transcribe, Bedrock, S3, and CloudWatch — every service we use to handle PHI.
Will you sign a BAA with our organization?
Yes. We sign BAAs with all covered entities and business associates. Contact us at info@medicalcoding.co to request a BAA before you begin using MediCode AI with real patient data.
How long is PHI retained?
Encounter summaries and codes are retained as long as your clinic account is active. Audit logs are retained for 6 years per HIPAA requirements. Audio is deleted immediately after transcription.
What happens if there is a data breach?
We follow the HIPAA Breach Notification Rule. In the event of a breach affecting unsecured PHI, we will notify affected individuals within 60 days and report to HHS as required.

Ready to Get Started?

Contact us to request a BAA, ask compliance questions, or get a demo with your specialty's encounter types.

Request a BAA Talk to Sales