HIPAA Compliance in AI

How NephroAssist protects patient data while delivering AI-powered tools for nephrology practices.

Executive Summary

NephroAssist takes a security-first approach to AI in healthcare. Our tools are designed with HIPAA compliance as a foundational requirement, not an afterthought. We maintain Business Associate Agreements (BAAs) with all covered entities, process PHI exclusively on HIPAA-eligible infrastructure, and implement comprehensive administrative, physical, and technical safeguards as required by the HIPAA Security Rule.

The Challenge: AI and Protected Health Information

Artificial intelligence offers transformative potential for healthcare operations—from automating routine tasks to extracting insights from unstructured data. However, deploying AI in healthcare settings requires careful attention to regulatory compliance, particularly the Health Insurance Portability and Accountability Act (HIPAA).

Many AI tools process data through third-party servers, potentially exposing protected health information (PHI) to unauthorized access. Generic AI solutions rarely account for the specific requirements of healthcare compliance. NephroAssist was built from the ground up to address these challenges.

Our Compliance Framework

NephroAssist implements the three categories of safeguards required by the HIPAA Security Rule: administrative, physical, and technical. These safeguards work together to protect the confidentiality, integrity, and availability of electronic PHI (ePHI).

📋

Administrative Safeguards

Designated security officer responsible for HIPAA compliance
Workforce training on PHI handling and security protocols
Documented policies and procedures for all data operations
Regular risk assessments and security audits
Incident response plan for potential breaches

🏢

Physical Safeguards

Data hosted exclusively on AWS HIPAA-eligible infrastructure
Geographically redundant data centers with physical security
No PHI stored on employee devices or local servers
Controlled access to any systems containing patient data

🔐

Technical Safeguards

AES-256 encryption for data at rest
TLS 1.3 encryption for data in transit
Role-based access controls with least-privilege principle
Multi-factor authentication for all administrative access
Comprehensive audit logging of all PHI access
Automatic session timeouts and secure authentication

Product-Specific Compliance Approaches

Each NephroAssist product takes a tailored approach to compliance based on its function and the type of data it handles.

Patient Assist

Non-PHI by Design

Patient Assist answers general practice questions—locations, hours, insurance, providers. It never asks for or stores patient health information. Conversations are anonymized and contain no identifiable data.

No patient identification required
No health information collected
Conversations are not linked to patient records
Safe for public-facing website deployment

FaxAssist

HIPAA-Compliant Processing

FaxAssist processes faxes containing PHI within a secure, HIPAA-compliant environment. All processing occurs on AWS HIPAA-eligible infrastructure with BAAs in place.

PHI never leaves the secure AWS boundary
Human verification before any data export
Complete audit trail of all document access
Automatic data retention policies

Staff Assist

Internal Knowledge Base

Staff Assist provides answers from your practice's internal documentation. Access is limited to authenticated staff members, and the system can be configured to exclude sensitive information.

Role-based access controls
Content filtering capabilities
No external data exposure
Audit logging of all queries

📄

Business Associate Agreements

NephroAssist signs Business Associate Agreements (BAAs) with all covered entity customers. Our BAA establishes our obligations as a business associate under HIPAA, including:

• Implementing appropriate safeguards to protect PHI
• Reporting security incidents and breaches
• Ensuring subcontractors agree to equivalent protections
• Making PHI available for patient access requests
• Returning or destroying PHI upon contract termination

Infrastructure and Subprocessors

NephroAssist runs exclusively on AWS HIPAA-eligible services. AWS maintains a BAA with NephroAssist and provides HIPAA-compliant infrastructure including:

Amazon Bedrock for AI model inference
Amazon Textract for OCR processing
Amazon S3 for document storage
Amazon RDS PostgreSQL for structured data
Amazon Transcribe for voicemail transcription

All PHI processing occurs within the secure AWS boundary. We do not use consumer AI services (such as ChatGPT or consumer-tier APIs) for any operations involving patient data.

Questions About Compliance?

We understand that compliance is a critical concern for healthcare organizations evaluating new technology. Our team is happy to discuss our security practices, provide additional documentation, or address specific compliance questions from your IT or legal teams.