HIPAA & Data Compliance
Our technical, administrative, and physical safeguards for protecting clinical data under HIPAA, GDPR, and NDPR across the Medicsense cloud ecosystem.
Technical Safeguards
TLS 1.3 encryption in transit via Cloudflare WAF, AES-256 encryption at rest on Google Cloud SQL, JWT/bcrypt access controls, and stateless container isolation.
Administrative Safeguards
Role-based access control, zero-training commercial AI agreements, automated credit/audit logging, and 7-day encrypted disaster-recovery snapshots.
Physical Safeguards
Hosted exclusively inside Google Cloud Platform (us-central1) data centers certified under ISO/IEC 27001, SOC 1/2/3, and HIPAA/HITECH standards.
Compliance Architecture Overview
Medicsense Digital Consults is engineered from the ground up around healthcare data security and international regulatory compliance. Our security posture is designed to align with the U.S. Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy, Security, and Breach Notification Rules (45 CFR Parts 160 and 164), the HITECH Act, the European Union General Data Protection Regulation (GDPR), and the Nigeria Data Protection Regulation (NDPR).
Whether you are interpreting diagnostic radiographs in Mediscan AI, structuring bedside consultations in Clerk Aid, guiding point-of-care ultrasound in Sona AI, digitizing charts in Pic 2 Doc, or running clinical trial statistics in AI Research Analyst, every request traverses hardened, access-controlled cloud infrastructure.
Shared Responsibility & PHI De-Identification (Safe Harbor)
Compliance in clinical AI is a shared responsibility between Medicsense and the healthcare practitioner or institution:
Unless your institution has executed a formal Business Associate Agreement (BAA) with Medicsense, clinicians and researchers should strip direct patient identifiers (such as full names, medical record numbers, street addresses, telephone numbers, and Social Security or national ID numbers) prior to uploading images, lab sheets, or research spreadsheets, in accordance with the HIPAA Safe Harbor method (45 CFR § 164.514(b)).
To minimize data exposure, users can configure data retention to 'Immediate Purge' so uploaded clinical datasets are deleted immediately upon report generation.
Technical Safeguards (45 CFR § 164.312)
Our production environment enforces multi-layered cryptographic and runtime isolation:
All client-to-server and server-to-AI-provider communications are encrypted via TLS 1.2/1.3 and fronted by Cloudflare's enterprise Web Application Firewall (WAF) and DDoS mitigation layer.
Our FastAPI backend executes inside containerized Google Cloud Run instances in us-central1. Containers are ephemeral, process-isolated, and scale down to zero when idle, preventing persistent memory leakage across sessions.
Persistent records in Google Cloud SQL (PostgreSQL 15) and backup snapshots are encrypted at rest using AES-256. All API keys, JWT signing secrets, and database credentials are injected at runtime from Google Cloud Secret Manager and are never hardcoded in source repositories.
Medicsense accesses foundational multimodal models exclusively through commercial API tiers where customer inputs and outputs are contractually excluded from training or improving foundational models.
Administrative & Physical Safeguards
Beyond software controls, Medicsense enforces strict operational governance:
User accounts require email verification, bcrypt salted password hashing, and signed JSON Web Tokens (JWT). Administrative endpoints require explicit elevated privilege verification.
Platform interactions, authentication events, and AI compute transactions are logged with timestamps for security auditing. Automated daily database backups run at 03:00 UTC with a rolling 7-day retention policy.
All backend compute and database workloads reside in Google Cloud Platform's us-central1 (Iowa, USA) facilities, which maintain 24/7 biometric physical security, redundant power, and independent third-party HIPAA, HITRUST, SOC 2 Type II, and ISO 27001 certifications.
Business Associate Agreements (BAAs) & Institutional Deployment
For U.S. Covered Entities, hospital networks, diagnostic imaging centers, and clinical research organizations that require processing of unredacted Protected Health Information (ePHI), Medicsense offers Enterprise Institutional Onboarding.
Institutional plans include a countersigned HIPAA Business Associate Agreement (BAA), dedicated database and storage isolation, custom data-retention enforcement, and priority compliance support. To request a BAA for your organization, please contact our compliance team.
Incident Response & Breach Notification
Medicsense maintains an active security incident response protocol. In the unlikely event of a confirmed breach of unsecured Protected Health Information or personal data, Medicsense will notify affected institutional partners and users without unreasonable delay—and no later than the statutory timelines mandated by the HIPAA Breach Notification Rule (45 CFR §§ 164.400–414), GDPR Article 33, and NDPR.
To report a potential security vulnerability or compliance concern, email medicseneseconsults@gmail.com with the subject line 'SECURITY / HIPAA REPORT'.