HIPAA PHI Storage Encryption AISS

1. Where Is PHI Stored? (Data Residency & Hosting)

🔹 MedSiteAI (Websites & Patient Chatbots)

• Hosting Provider: AWS (Amazon Web Services) in HIPAA-eligible data centers (us-east-1, us-west-2).
• Data Residency: All PHI collected via forms, chatbots, or appointment requests stays in the U.S. (No offshore storage).
• Isolation: Patient data is logically separated in a dedicated VPC (Virtual Private Cloud) with private subnets.
• Retention Policy:

- Chatbot transcripts: 30 days (auto-deleted unless exported to your EHR).

- Form submissions: 90 days (configurable per clinic).

Example: A dermatology clinic using MedSiteAI’s chatbot for acne consult requests will have all patient messages stored in AWS S3 buckets with server-side encryption (SSE-S3). If the clinic integrates with Athenahealth, data auto-syncs and deletes from our servers within 24 hours.

🔹 MedReceptionist (AI Phone System)

• Hosting: AWS (same HIPAA-eligible regions as MedSiteAI).
• Call Recordings:

- Stored in AWS S3 with AES-256 encryption.

- Auto-deleted after 30 days unless flagged for compliance (e.g., dispute resolution).

• Transcripts (Voicemail-to-Text):

- Processed via AWS Transcribe (HIPAA-eligible).

- Not stored—only delivered to your email/EHR via TLS 1.2+ encrypted channels.

Real-World Case: An urgent care clinic using MedReceptionist for after-hours calls had a patient leave a voicemail with symptom details. The transcript was never stored on our servers—only emailed via HIPAA-compliant encrypted email (if configured).

🔹 MedReceptionist Voice Agent (Call Automation)

• Hosting: AWS (same as above).
• PHI Handling:

- If a patient says, “I need a refill for my blood pressure meds,” the audio is processed in real-time and discarded immediately after generating the response.

- No persistent storage of raw audio unless explicitly enabled for training (opt-in only).

🔹 AI Scribe (SOAP Notes Automation)

• Hosting: AWS (HIPAA-eligible).
• Audio Processing:

- Doctor-patient conversations are streamed to AWS Transcribe (HIPAA-eligible).

- Transcripts are encrypted at rest (AES-256) and deleted within 1 hour of note completion.

• EHR Integration:

- SOAP notes push directly to Epic, Athena, or other EHRs via HL7 FHIR APIs (TLS 1.3).

- No PHI remains in AISS systems after delivery.

Example: A family medicine doctor using AI Scribe for 20 patient visits/day generates ~50,000 words of transcripts/month. None of this data is stored—only the finalized SOAP note goes to the EHR.

2. How Is PHI Encrypted? (In Transit & At Rest)

🔹 Encryption in Transit (Data Moving Between Systems)

Why This Matters:

• A podiatry clinic using MedSiteAI’s online intake forms has patient data encrypted before it leaves the browser (via HTTPS).
• A mental health practice using MedReceptionist for call routing ensures no eavesdropping on VoIP calls (SRTP encryption).

🔹 Encryption at Rest (Stored Data)

*\Customer-Managed CMK (Customer Master Key): For enterprise clients, we allow BYOK (Bring Your Own Key) for extra control.

Example:

• A dental clinic storing 100GB/month of call recordings in MedReceptionist has each file individually encrypted with a unique key.
• A med spa using MedSiteAI’s HIPAA forms has all submissions encrypted before hitting the database.

3. Who Can Access PHI? (Role-Based Permissions & Audits)

🔹 Access Controls (Zero-Trust Model)

• AISS Employees:

- No direct access to PHI unless explicitly granted for support (requires two-factor auth + audit log).

- Support access is time-limited (max 1 hour, auto-revoked).

• Clinic Staff:

- Role-based permissions (e.g., Front Desk = View/Edit Appointments Only).

- Multi-Factor Authentication (MFA) enforced for all admin logins.

Screenshot Description (Hypothetical Admin Dashboard):

• Audit Log Example:

>   [2024-05-20 14:32] User: jane.doe@clinic.com (Role: Admin)

> Action: Exported 5 patient chatbot transcripts to EHR

> IP: 192.168.1.100 | Device: Chrome (MacOS)

>

- Permission Settings:

• ✅ Front Desk: View/Edit Appointments
• ❌ Front Desk: Access Billing Data
• ✅ Doctor: View/Edit SOAP Notes

🔹 Business Associate Agreements (BAAs)

• All AISS products come with a pre-signed BAA (no extra cost).
• Subprocessors:

- AWS (HIPAA-compliant)

- Twilio (for SMS/voice, HIPAA BAA in place)

- Google (only for non-PHI analytics, excluded from BAA)

Why This Matters for Compliance:

• A chiropractic clinic using MedReceptionist + Twilio SMS is covered because both AISS and Twilio have BAAs.
• If a breach occurs, the BAA ensures liability is shared per HIPAA rules.

4. What Happens If There’s a Breach?

🔹 Incident Response Plan (Tested Quarterly)

1. Detection:

- AWS GuardDuty + custom anomaly detection flags unusual access (e.g., 100+ PHI exports in 1 minute).

1. Containment:

- Automated lockout of suspicious IPs/users.

- Isolation of affected data (no deletion until forensic analysis).

1. Notification:

- Clinic notified within 1 hour (HIPAA requires 60 days max, but we do <1 hour).

- HHS + affected patients notified within 60 days (if >500 records exposed).

1. Remediation:

- Root cause analysis (RCA) in 72 hours.

- Free credit monitoring for affected patients (if required).

Real-World Test Case:

• In Latest audit: Q2 2026, we simulated a breach where a hacked admin account tried to export PHI.
• Result: System blocked the export, revoked access, and alerted the clinic owner in 42 seconds.

5. How Do We Prove HIPAA Compliance?

🔹 Third-Party Audits & Certifications

What This Means for You:

• No need for your clinic to audit us—we’ve already passed HIPAA and SOC 2 audits.
• Reduces your compliance burden when using our tools.

🔹 Penetration Testing (Annual)

• Conducted by: Cure53 (Berlin-based security firm)
• Last Test: Latest audit: Q2 2026
• Findings:

- 0 critical vulnerabilities in PHI storage.

- 1 medium-risk issue (fixed within 7 days).

Example Fix:

• A potential SQL injection risk in MedSiteAI’s form handler was patched before any data was exposed.

6. What Should Clinic Owners Do to Stay Compliant?

🔹 Your Responsibilities (Even with AISS)

1. Sign the BAA (we provide it—just e-sign in 2 minutes).
2. Train Staff:

- No sharing logins (each user gets a unique, audited account).

- Phishing tests (we offer free templates for clinics).

1. Configure Integrations Securely:

- Use TLS 1.2+ for EHR connections (we enforce this by default).

- Disable SMS if not HIPAA-compliant (Twilio is fine; regular texting is not).

1. Monitor Access:

- Review audit logs monthly (we provide automated reports).

Checklist for Clinic Admins:

• [ ] BAA signed (provided in onboarding).
• [ ] MFA enabled for all staff.
• [ ] EHR integration tested (no PHI leakage).
• [ ] Staff trained on HIPAA + AISS tools.

7. Common Questions from Clinic Owners

❓ “Can I use MedSiteAI’s chatbot for intake forms with PHI?”

✅ Yes. All chatbot data is encrypted (AES-256) and auto-deleted in 30 days unless exported to your EHR.

❓ “Is MedReceptionist’s voicemail transcription HIPAA-compliant?”

✅ Yes. Audio is processed in a HIPAA-eligible AWS region, and transcripts are delivered encrypted (no storage).

❓ “Does AI Scribe store patient audio?”

❌ No. Audio is streamed, transcribed, and discarded—only the SOAP note is saved (in your EHR).

❓ “What if a patient asks for their data to be deleted?”

✅ We comply with HIPAA’s Right to Erasure.

• Process:

1. Clinic submits request via support@aiscansolutions.com.

2. We verify identity (clinic admin + patient confirmation).

3. Data deleted within 24 hours (with confirmation).

❓ “Can I use AISS tools without a BAA?”

❌ No. We require a BAA for all healthcare clients (provided free in onboarding).

8. Pricing & Which Product Fits Your PHI Needs

Example Cost Breakdown:

• A 5-doctor family practice using:
• MedSiteAI ($299/mo) for website + chatbot
• MedReceptionist ($99/mo) for phone system
• AI Scribe (included) for notes
• Total: ~$400/mo (vs. $1,200+/mo for traditional EHR + phone systems)

🚀 Next Steps: Secure Your Clinic’s PHI with AISS

If you’re a clinic owner looking for HIPAA-compliant AI tools that actually work (without the compliance headaches), here’s how to get started:

1. For HIPAA Websites & Chatbots → Try MedSiteAI (14-day free trial)
2. For AI Phone & Voicemail → Try MedReceptionist ($29/mo plan available)
3. For Call Automation & SOAP Notes → Book a Demo

💡 Pro Tip: Schedule a free HIPAA compliance audit with our team—we’ll review your current setup and identify risks in <30 minutes. Final Note: At AISS, we don’t just say we’re HIPAA-compliant—we prove it with audits, encryption, and zero PHI leakage. Your patients’ data is safe with us. Have more questions? Email compliance@aiscansolutions.com—we respond in <2 hours.