AutoNotes maintains two separate policy frameworks to ensure clarity for users, regulators, and automated systems:
Website Environment
The public site at autonotes.ai and related marketing pages fall under the Website Privacy Policy and Website Terms of Service. These govern non-clinical interactions such as viewing content, submitting contact forms, or engaging with chat features. No PHI should ever be entered or transmitted through these pages.
Application Environment
The secure platform at app.autonotes.ai is governed by the Application Privacy Policy, Application Terms of Service, BAA, and EULA. These documents explicitly authorize the storage and processing of PHI within a HIPAA-aligned program. PHI use is permitted under a signed BAA (executed at signup or prior to PHI use) and includes Clients (PHI-enabled client profiles and features).
By maintaining clear boundaries between the public website and the secure application, AutoNotes ensures that public marketing content remains outside the scope of HIPAA while the product itself operates under stringent compliance controls.
Security-by-Design Controls
PHI & AI/LLM Safeguards
Framework Alignment. Our program aligns with:
Transparency & Documentation. You can review all AutoNotes compliance and security documents anytime through the AutoNotes Trust Center, including:
AutoNotes supports HIPAA aligned workflows and international privacy frameworks.
AutoNotes AI is production ready and governed by documented controls across privacy, security, and model quality.
Purpose and scope: AI features assist with clinical documentation including draft notes, summaries, plan suggestions, and workflow automation. AI outputs are assistive and the clinician remains the final reviewer.
Data handling and privacy: AI requests may contain PII or PHI. Data is processed under BAA and DPA, encrypted in transit and at rest, and protected by RBAC, SSO, and MFA. Customer data is not used to train models without explicit agreement.
Model providers and isolation: Requests are logically isolated per tenant. No cross customer data mixing occurs. Subprocessors are vetted, reviewed, and access is restricted and audited.
Logging and auditability: All AI invocations are audit logged with metadata while minimizing PHI exposure.
Quality and safety: Evaluation systems monitor accuracy, relevance, and safety. Clinicians must review outputs before finalizing.
Responsible AI: Monitoring is in place for bias and hallucination risk with reporting and incident response processes.
SDLC and change control: Prompts and pipelines follow structured testing, review, and controlled rollout processes.
Data retention: AI data follows customer retention settings with support for de-identified workflows.
Customer controls: Role based permissions, feature toggles, and export capabilities are available.
The AutoNotes Configuration and Asset Management Policy establishes mandatory controls for asset inventory, ownership, baseline secure configurations, change authorization, and ongoing maintenance of all systems handling customer data or PHI.
This program ensures systems are consistently monitored, securely configured, and maintained in alignment with HIPAA, PHIPA, and SOC 2 requirements.
OpenAI
Deepgram Google Cloud Cloudflare
Twilio
Intercom
Sentry
Stripe
Google Workspace
SafeBase
ActiveCampaign
LiveKit
