Security and patient data

The notes you analyze can contain protected health information (PHI). This page describes where that data goes, what never receives it, and the controls you have over it.

Where your notes go

When you analyze a note, your browser sends the note text straight to the MedChartScan E/M API. For a batch, your browser also reads the files, and only the notes go to the API. The note never passes through the MedChartScan website's own server.

The API analyzes the note with an AI model and stores the note and its report in a database. The API, the AI model service, and the database run on HIPAA-eligible services covered by business associate agreements.

A note's text is stored with its result, so that you can open the note beside the report. If a single analysis fails, its note text isn't stored. A failed note in a batch keeps its text for 7 days, so that you can retry it, and then the text and the note's reference are deleted.

What never receives patient data

Note text, references, codes, and reports aren't sent to any of the following:

Email. Emails from MedChartScan say that something happened, such as a finished batch or a deletion warning, and link to the app. They don't contain note content, codes, or references.
Payments. Stripe receives only what it needs to take a payment. It never receives notes or results.
Sign-in. The sign-in system holds your account details, not notes or results.
Web addresses. Note content never appears in a URL.
Logs. The services' logs don't record note text, results, or quotes.
Analytics. The app has no analytics or session recording. The sign-up, sign-in, and password-reset pages load a bot check from Cloudflare. It runs only on those pages, where no notes are entered.
The audit log. It records who did what, never note content.

Delete data

You control how long results are kept:

Test results made while your organization is in testing mode are deleted 30 days after they're created. Owners get an email 7 days and 1 day before. For more information, see Test mode and the BAA.
Live results are kept until someone in your organization deletes them.

To delete results, select them on the Results page and delete them. Deleting removes the note and its report for everyone in the organization, and it can't be undone. The owners get an email that says who deleted how many results. Owners and admins can delete any result; members can delete the results they ran. A result's reference is deleted with it, and a batch is deleted, with its name, when its last result is deleted.

Delete the organization

An owner can delete the whole organization:

In the sidebar, click Settings.
In the Danger zone section, click Delete organization.
Type the organization's name exactly as shown, and then click Delete organization.

Deleting the organization removes every note, result, API key, and member, and signs you out. The dialog states how many unspent credits are forfeited. Signed BAA records and billing records are kept, as required by law, and so are the audit log's events. None of them contain note content.

Audit log

The audit log lists who did what in your organization, newest first. Only owners can see it: in the sidebar, click Audit log.

The log records, for example, sign-ins, invitations and role changes, settings changes, the BAA signature, and each time someone analyzes, opens, exports, or deletes a result. Each event shows when it happened, what happened, who did it, its target, and the IP address. To show one kind of event, choose it in Filter by action. Actions by MedChartScan support appear as MedChartScan support.

Two-step verification

Two-step verification asks for a 6-digit code from an authenticator app each time you sign in, in addition to your password or your Google account.

Required once the BAA is signed. In an organization whose status is Active or Paused, everyone signs in with two-step verification: owners, admins, members, and billing users. Anyone who hasn't set it up is asked to on the next page they open in that organization, and can't open it until they do. The owner who signs the BAA sets it up first. Accepting an invitation to such an organization works without it, but nothing in the organization opens until you set it up.
Wrong codes lock it for a while. After 5 wrong codes in a row, codes aren't accepted for 15 minutes.
Turning it off takes a current code. To turn it off, you enter a code from your authenticator app or one of your backup codes, and your password if your account has one. A signed-in browser alone can't turn it off.
Changes need a recent sign-in. Turning two-step verification on or off needs a sign-in from the last 15 minutes. If it's been longer, the app asks you to sign in again and then brings you back.
You're told when it's turned on or off. MedChartScan emails you when two-step verification is turned on or off for your account. If you didn't make the change, reset your password and write to support@medchartscan.io.
Backup codes work after setup. Backup codes count only once setup is finished with a code from the authenticator app.
Optional in testing mode. In a Pending organization, every user can turn it on, and the app reminds owners until they do.
It stays on for owners and admins of a live organization. While you're an owner or admin of an organization with a signed BAA, Settings doesn't offer to turn it off.
API keys aren't affected. Requests with an API key don't sign in, so they don't ask for a code.

To set it up from Settings:

In the sidebar, click Settings.
In the Two-step verification section, click Set up two-step verification.
Enter your Current password, and then click Continue. If you sign in only with Google, there's no password to enter: click Continue.
Scan the QR code with an authenticator app, or type the setup key into the app.
Enter the 6-digit code that the app shows, and then click Verify and turn on.
Save the backup codes somewhere private, and then click I saved these codes. Each backup code works once, if you lose your phone. The codes are shown only once.

When the app asks you to set it up before you open an organization, the same steps appear on their own page, and you return to the page you were opening.

To turn it off from Settings, when your organizations allow it:

In the sidebar, click Settings.
In the Two-step verification section, click Turn off two-step verification.
Enter your Current password. If you sign in only with Google, there's no password field.
Enter the 6-digit code that your authenticator app shows, or one of your backup codes, and then click Turn off.

MedChartScan emails you that two-step verification was turned off. If the app says that the change needs a sign-in from the last 15 minutes, click Sign in again, and then repeat these steps.

If your organization's sign-in page shows Continue with Google, you can sign in or create an account with your Google account instead of a password. Google confirms your email address, so there's no verification email. If you have two-step verification on, or your organization's BAA is signed, you enter your code after Google, on the Enter your code page.

Sessions

You're signed out after 30 minutes without activity. The sign-in page then says that you were signed out after 30 minutes without activity.
You sign in again at least every 12 hours, even while you're active. The 12 hours count from when you signed in: turning two-step verification on or off doesn't restart them.
MedChartScan emails you when your password is reset, and the reset signs out every session.
Passwords have at least 12 characters, and every account verifies its email address before it signs in.

Your responsibilities

Some of the protection of patient data depends on how your organization uses MedChartScan:

Don't analyze real patient data until an owner signs the BAA.
Give each person the role they need. Members and billing users see less than owners and admins.
Keep exported PDFs and copied JSON as you keep other patient records. They're outside MedChartScan once exported.
Don't put patient names or other identifiers in a batch reference, a batch name, or an API client reference.
Don't send patient data to support by email. When you write to support@medchartscan.io, include your Organization ID for support (owners and admins find it in Settings) and the link to any result you're asking about. The link contains only an ID. Never include note text.