Security and the business associate agreement
Consults contain protected health information. PaigeFlow operates as a business associate of the physician practice. This page states what is in place today and what is required before any real patient information is handled, without overstating either.
Where we are
PaigeFlow is in limited release with a design partner practice and is operating on fictional patient data only. The controls below are marked with their current status so your compliance team can see exactly what has been completed.
Business associate agreement Before live use
A signed BAA is executed with the physician practice before any consult involving real patient information is handled, and with every subprocessor that transmits or stores consult content. No practice goes live without one.
Encryption in transit and at rest In place
All consult content, including imaging, is encrypted in transit and at rest. Imaging is held in access-controlled storage and delivered to the surgeon through expiring links rather than public URLs.
Tenant isolation In place
Each practice is isolated at the database level with row-level security. Access to a consult requires an authenticated account belonging to that practice. Isolation is verified by an automated test suite on every change.
Authenticated access and roles In place
Access is by individual account with roles for surgeon, advanced practice provider, and office staff. There are no shared logins.
Audit trail In place
Every message, decision, notification and access event is logged with a timestamp and an actor. The trail is visible to the practice and available for export.
HIPAA-eligible hosting Before live use
Production infrastructure moves to a HIPAA-eligible environment under a signed agreement before the first consult involving real patient information.
Written policies and risk assessment In progress
Security policies, workforce training, incident response and a documented risk assessment are being completed ahead of live use.
Independent audit Planned
We have not completed a SOC 2 or HITRUST audit. We will not claim one until a report exists, and we will say so plainly when it does.
How patient information moves
Consult content passes through a small number of services. Each is under a business associate agreement before real patient information is handled.
| Function | What it handles | BAA |
|---|---|---|
| Telephony and messaging | Inbound calls and texts to the consult line, outbound notifications | Before live use |
| Application hosting and database | Consult records, transcripts, audit trail | Before live use |
| Imaging storage | Radiographs sent by the requesting clinician | Before live use |
| Speech and language processing | Call transcription and field extraction | Before live use |
On model training
Consult content is not used to train machine learning models, ours or anyone else’s. Processing agreements with language and speech providers are executed with retention disabled before real patient information is handled.
Patient and family contact
The system contacts a patient or family member only under conditions your department can verify.
Consent is captured first
A patient or a designated family member is asked at the bedside whether they would like an explanation of the planned procedure. The consent, the recipient and the time are recorded against the consult before anything is sent.
Content is pre-approved
Explanations come from a library the surgeon has written and approved, versioned so the exact text a family received is always retrievable. The assistant does not compose clinical content.
Questions are not answered clinically
The assistant answers only from an approved list of questions. Anything else is captured and shown to the surgeon; it is never answered by the system.
This is not informed consent
Education is not consent for a procedure. The surgeon obtains consent in person, as always.
Stopping is immediate
Any recipient can stop messages at any time, and the system will not contact them again.
Talk to us about your department
We can walk through the consult record, the retention and access model, and what a trial with one on-call surgeon would involve. Nothing goes live in a department without your knowledge.