The chart stays in your EHR
AIdMD reads clinical data when it is needed, through your approved connection. It keeps no persistent copy of your patients’ medical records.
SECURITY & PRIVACY
Their trust in you.
Your trust in us.
AIdMD is built for clinical work. Privacy, access controls, and human review come first.
HIPAA compliantSOC 2 certified
Patient data is never used to train public AI models.
Your clinical information belongs in your care work. AIdMD runs in a private AI environment, keeps each customer’s data apart, and controls who has access.
PATIENT DATA
Where does the chart data go?
It stays in your EHR. Here is what AIdMD reads, what it keeps, and for how long.
Conversations end with the session
By default, AI conversations are not kept after the session. Connection tokens are deleted when you log out or the session ends.
Audit logs are kept for six years
Audit logs are kept for six years so activity can be reviewed. They are separate from the medical record, which stays in your EHR.
PROTECTION AT EVERY LAYER
A strong foundation.
By design.
HIPAA-Compliant Architecture
- BAA available with covered entities
- Hosted on Microsoft Azure HIPAA-eligible services
- Microsoft BAA in place
Private AI Environment
- Azure OpenAI used exclusively
- PHI is not used for model training or fine-tuning
- Tenant data isolation enforced
Controlled Data Handling
- Clinical data fetched on demand — not stored persistently
- No persistent copy of medical records
- AI conversations not persisted beyond the session by default
Auditability & Access Control
- SOC 2 certified — independent third-party audit
- Role-based access control (RBAC)
- Admin audit tooling and approval workflows
- Audit logs retained for 6 years
Encryption & Authentication
- TLS 1.2+ in transit · AES-256 at rest
- Azure Key Vault for secrets management
- SMART on FHIR OAuth 2.0 + PKCE
- Token deletion on logout / session end
HOSTING & DEPLOYMENT
A clear plan.
From the start.
Hosted on Microsoft Azure
AIdMD runs on Azure HIPAA-eligible services, in a private AI environment, with controlled access.
Planned with your team
Before we agree on a plan, we go through where your data must be stored, your EHR connection, and your security needs with you.
YOUR CLINICIANS STAY IN CONTROL
AI drafts.
You decide.
Clinical judgment stays with the clinician. Every note, order, and action is reviewed and signed before it is final.
New integrations start with read-only access.
Your governance team approves write-back workflow by workflow.
Once you sign, approved content posts back automatically.
Role-based access and audit logs let you review what happened.
LET’S TALK THROUGH THE DETAILS
Good security welcomes
good questions.
We can go through your security questionnaire, your setup needs, and the Business Associate Agreement with you.
FROM THE JOURNAL
Guides for your next question.
Five questions to ask before deploying clinical AI
A checklist for your review: data protection, integration, clinician control, and how to measure success.
How should a health system choose documentation AI?
What to check first: the BAA, security proof, write-back, governance, then note quality.