Security & HIPAA
Your patients’ trust, protected.
Patients tell you things they tell almost no one else. The software that holds those words should be built with the same respect you bring to the room.
ChiroUnchained keeps your records on a computer in your own office, encrypts connections to your office server, logs chart access, and puts a Business Associate Agreement in place with every practice, on every plan.
The short version
HIPAA compliant at every level
Compliance is not an add-on tier or a form you request later. A Business Associate Agreement is included for every practice on every plan, and the way the system is built backs it up. Here is what that means in plain terms.
Your data, your office
Patient records, notes, reports and the access log are stored on a computer in your office. Your office server does not accept connections from the internet.
Encrypted and logged
Connections from other computers to your office server are encrypted. Opening a patient’s chart is written to an access log, allowed or refused, so you can see who opened what and when.
Paperwork that matches
You sign a Business Associate Agreement with us. The AI and transcription services that process patient information are named below, so there is nothing hidden in the chain.
- Records stored in your office, on your hardware
- A Business Associate Agreement for every practice, every plan
- Every connection from another computer to your office server is encrypted
- Every patient chart open is logged, allowed or refused
- Backups are encrypted before they are written
- Each person signs in as themselves, with the access their role allows
- A new patient’s first visit recording does not start until they have acknowledged a plain recording notice, in English or Spanish, or the doctor has marked consent obtained on paper (unless your own intake form already carries it); the choice is kept in the record
How information moves
Follow a visit from the room to the record
Most software asks you to trust a black box. Here is the whole path, step by step.
1 · In the room
You talk through the visit. The audio travels over an encrypted connection to AssemblyAI, which turns it into text.
2 · Your office server
The text lands on the computer in your office. The note, the report and the patient record are stored here, on your hardware.
3 · Writing and analysis
When the system drafts or checks a note, the text goes to AWS Bedrock over an encrypted connection and the result comes straight back to your office server.
- Stored in your officePatient records, notes, reports, the access log and the backups live on hardware in your building. Copies leave only for the services listed below, such as the email you send to a patient.
- The services that touch patient informationAWS Bedrock handles AI writing and analysis. AssemblyAI handles transcription. Both process patient information under Business Associate Agreements. Email you send to a patient goes out through Amazon’s email service.
- Nothing in betweenNo tunnel into your office. No remote door that someone has to remember to close.
The safeguards
What protects the record, one layer at a time
Your records stay in your office
Patient records, notes and recordings are stored on a computer in your office, under your roof. They are yours, kept on your hardware.
No way in from the internet
The office server answers only to computers on your own office network, over an encrypted HTTPS connection with a certificate issued for your practice. There is no tunnel from the internet to your office. The clinical services behind it listen only on the server itself.
Individual sign-ins, role by role
Each person signs in with their own account, and sees what their role allows: doctor, front desk, staff. Passwords are stored as one-way hashes, session cookies are protected, and the PIN on a shared console locks after repeated wrong tries.
Every chart open and every sign-in is logged
Sign-ins are recorded. Opening a patient’s chart, allowed or refused, is written to an access log that the software itself cannot edit or delete. Corrections to a finished note are logged with who made them, when, and what changed.
A Business Associate Agreement with every practice
HIPAA requires one wherever a vendor handles patient information on your behalf. We sign one with every practice, on every plan, as part of getting started. It is not an upgrade.
AWS Bedrock and AssemblyAI
Clinical writing and analysis run through AWS Bedrock. Speech-to-text runs through AssemblyAI. Both operate under HIPAA business associate agreements, and both connections are encrypted.
Your backups are locked, and stay with you
Database backups are encrypted before they are written to disk, saved to a drive in your office, and checked after each run by decrypting and reading them back.
At a glance
The facts in one table
| Where records are stored | On a computer in your office |
|---|---|
| Connections from other computers to your office server | Encrypted (HTTPS), certificate issued for your practice |
| Internet access to your office server | None. Your office network only |
| AI writing and analysis | AWS Bedrock, under a HIPAA agreement |
| Transcription | AssemblyAI, under a HIPAA agreement |
| Business Associate Agreement | Every practice, every plan |
| Sign-in | Individual accounts, by role |
| Access log | Patient chart opens, allowed or refused, plus sign-ins |
| Database backups | Encrypted, kept on a drive in your office |