HIPAA Compliance

1. Our Role Under HIPAA

When CareOS processes, transmits, or stores PHI on behalf of a covered healthcare provider, we act as a Business Associate as defined under 45 C.F.R. § 160.103. We operate under a signed Business Associate Agreement (BAA) with each covered entity client and comply with all applicable provisions of the HIPAA Privacy, Security, and Breach Notification Rules, as well as the HITECH Act.

2. Administrative Safeguards

• Documented HIPAA Privacy and Security policies and procedures, reviewed annually.
• Designated Privacy Officer and Security Officer responsible for compliance oversight.
• Mandatory HIPAA training for all CareOS workforce members at onboarding and annually thereafter.
• Risk analyses and risk management activities consistent with 45 C.F.R. § 164.308(a)(1).
• Workforce sanction policy for violations of HIPAA policies.
• Incident response and breach notification procedures.
• Vendor due-diligence and signed subcontractor BAAs with all downstream service providers that handle PHI.

3. Physical Safeguards

• PHI is processed and stored in SOC 2 Type II / ISO 27001 certified cloud data centers located in the United States.
• Strict facility access controls, 24/7 monitoring, and environmental protections maintained by our infrastructure providers.
• Workforce devices accessing PHI are required to be encrypted, password-protected, and remotely wipeable.
• Secure disposal of media containing PHI in accordance with NIST SP 800-88 guidelines.

4. Technical Safeguards

• Encryption in transit: All communications use TLS 1.2 or higher.
• Encryption at rest: PHI is stored using AES-256 encryption.
• Access controls: Role-based access, least-privilege principles, and unique user IDs for all workforce members.
• Authentication: Multi-factor authentication required for all systems with access to PHI.
• Audit controls: Comprehensive logging of access to PHI, retained for at least six (6) years.
• Integrity controls: Mechanisms to detect unauthorized alteration of PHI.
• Transmission security: Secure APIs and verified endpoints for all PHI exchange.

5. Human-in-the-Loop Privacy Controls

CareOS's AI voice agent is intentionally designed to minimize PHI exposure. Our agent never repeats sensitive identifiers (such as full date of birth, full SSN, or full medical record numbers) aloud, and requires patient self-verification before any account-specific information is shared. All account-altering actions (scheduling, message routing, escalations) are surfaced to clinic staff for review and approval through our human-in-the-loop dashboard.

6. Breach Notification

In the event of a Breach of Unsecured PHI, CareOS will notify the affected covered entity without unreasonable delay, and in no case later than sixty (60) calendar days after discovery, in accordance with 45 C.F.R. § 164.410. Notifications will include the information required by HIPAA to allow the covered entity to fulfill its breach-notification obligations to individuals, HHS, and, where required, the media.

7. Minimum Necessary Standard

CareOS uses, discloses, and requests only the minimum amount of PHI reasonably necessary to accomplish the intended purpose, consistent with 45 C.F.R. § 164.502(b). We work with each client to scope data access narrowly to the workflows the practice has authorized.

8. Patient Rights

Patients should direct requests regarding their PHI — including access, amendment, accounting of disclosures, restrictions, and confidential communications — to their healthcare provider, who is the covered entity responsible for responding under HIPAA. CareOS will support covered entities in fulfilling these requests as required by our BAA.

9. Requesting a BAA or Reporting a Concern

Healthcare providers may request an executable Business Associate Agreement, and any individual may report a privacy or security concern, by contacting: