Compliance

HIPAA Compliance

The healthcare platforms Autosapien builds — including XEHR and RCM Employee, developed for XEHR LLC — are built from the ground up for HIPAA compliance. Protecting patient data is not an afterthought; it's our foundation.

Our Commitment

Autosapien builds the safeguards below into the healthcare platforms we develop, so the clinical data, revenue cycle information, and patient records they process stay under strict HIPAA-compliant controls.

XEHR and RCM Employee are XEHR LLC products. XEHR LLC handles all Protected Health Information (PHI) in them, and practices that use them sign their Business Associate Agreements (BAAs) with XEHR LLC. For other companies that engage Autosapien to build their products, we sign the BAA directly.

Administrative Safeguards

  • Designated Privacy & Security Officers
  • Workforce training on PHI handling
  • Access management and authorization policies
  • Incident response and breach notification procedures
  • Regular risk assessments and remediation

Physical Safeguards

  • SOC 2 certified Google Cloud data centers
  • Physical access controls and monitoring
  • Workstation security policies
  • Device and media disposal procedures

Technical Safeguards

  • AES-256 encryption for PHI at rest
  • TLS 1.3 encryption for PHI in transit
  • Unique user identification and MFA
  • Automatic session timeout and audit controls
  • Emergency access procedures

AI-Specific HIPAA Controls

Our AI systems that process PHI operate under additional safeguards:

  • AI models are trained on de-identified data; PHI is never used in model training
  • All AI inference on PHI occurs within HIPAA-compliant isolated environments
  • AI outputs involving clinical data are logged and auditable
  • Human-in-the-loop review for critical clinical AI decisions
  • Model outputs are validated against clinical standards before delivery
  • Strict data boundaries prevent PHI from crossing tenant environments

Breach Notification

Breach notification for XEHR and RCM Employee is handled by XEHR LLC, which holds the patient data. The platforms we build include the logging and audit trails that incident response depends on.

Request a BAA

When we develop a product for your company that handles PHI, Autosapien signs a Business Associate Agreement (BAA) with you. To request one or ask about our HIPAA compliance program, contact our compliance team at compliance@autosapien.com.