The chart stays in your EHR
AIdMD reads clinical data on demand through your approved connection and keeps no persistent copy of your patients’ medical records.
SECURITY & PRIVACY
Their trust in you.
Your trust in us.
AIdMD is built for clinical environments, with privacy, access controls, and human oversight at the center of the experience.
HIPAA compliantSOC 2 certified
Patient data is never used to train public AI models.
Your clinical information belongs in your care workflow. AIdMD uses a private AI environment with tenant isolation and controlled access.
PATIENT DATA
Where does the chart data go?
It stays in your EHR. Here is what AIdMD reads, what it keeps, and for how long.
Conversations end with the session
By default, AI conversations are not kept beyond the session, and connection tokens are deleted when you log out or the session ends.
Audit logs are kept for six years
Audit logs support oversight and are retained for six years. They are separate from the medical record, which stays in your EHR.
PROTECTION AT EVERY LAYER
A strong foundation.
By design.
HIPAA-Compliant Architecture
- BAA available with covered entities
- Hosted on Microsoft Azure HIPAA-eligible services
- Microsoft BAA in place
Private AI Environment
- Azure OpenAI used exclusively
- PHI is not used for model training or fine-tuning
- Tenant data isolation enforced
Controlled Data Handling
- Clinical data fetched on demand — not stored persistently
- No persistent copy of medical records
- AI conversations not persisted beyond the session by default
Auditability & Access Control
- SOC 2 certified — independent third-party audit
- Role-based access control (RBAC)
- Admin audit tooling and approval workflows
- Audit logs retained for 6 years
Encryption & Authentication
- TLS 1.2+ in transit · AES-256 at rest
- Azure Key Vault for secrets management
- SMART on FHIR OAuth 2.0 + PKCE
- Token deletion on logout / session end
HOSTING & DEPLOYMENT
A clear plan.
From the start.
Hosted on Microsoft Azure
AIdMD uses Azure HIPAA-eligible services, a private AI environment, and controlled access for clinical workflows.
Planned with your team
We review your data-residency needs, EHR connection, and security requirements together before agreeing the deployment plan.
YOUR CLINICIANS STAY IN CONTROL
AI drafts.
You decide.
Clinical judgment stays with the clinician. Every note, order, and action requires review and sign-off before it is finalized.
New integrations start with read-only access.
Your governance team approves write-back workflow by workflow.
Once you sign, approved content posts back automatically.
Role-based access and audit logs support oversight.
LET’S TALK THROUGH THE DETAILS
Good security welcomes
good questions.
We can walk through your security questionnaire, deployment needs, and Business Associate Agreement together.
FROM THE JOURNAL
Guides for your next question.
Five questions to ask before deploying clinical AI
A due-diligence checklist: data protection, integration, clinician control, and measuring success.
How should a health system choose documentation AI?
An evaluation order: BAA, security attestation, write-back, governance, then note quality.