Skip to content
Super Genius Labs
All docs
Genius Care · 04

Security, PHI handling, and the BAA

What Genius Care does with protected health information today: encryption, PHI minimization, audit logging, which tiers include a BAA, and what is not.

Updated

Genius Care is designed for HIPAA workloads. We do not claim certifications we have not completed, so this page states what is true today and what is on the roadmap.

What is in place

  • Encryption in transit and at rest. TLS 1.3 on the wire, AES-256 for stored data.
  • PHI minimization by design. The agent does not persist conversational PHI outside the system of record it books into. The voice path records bounded latency and token metrics plus PHI-safe operational failure events (a stalled turn, a deferred write), not call content.
  • Access logging. PHI access is logged for review. Those logs are bounded on purpose: they are not a replay of every model decision (see below).
  • Prompts and configuration are versioned in the repository, so a change to what the agent says is a reviewed change, not a live edit.

The Business Associate Agreement

A signed BAA covers PHI handling, breach notification, and audit obligations. It is included on the Practice and Enterprise tiers, and it is signed before any real-PHI workload runs. Starter and Pro do not include a BAA; they are meant for evaluation and for practices that keep PHI out of the call flow. See Plans and call caps for the tier table.

What is not yet true

  • Genius Care is not currently SOC 2 audited. The roadmap toward formal certifications is tracked publicly on the Genius Care page.
  • We do not describe the product as "HIPAA compliant". HIPAA compliance is a property of a covered entity's whole program, and we would rather show you the controls than use the phrase.
  • Operational logs are not a complete audit trail of every model decision. They are bounded metrics and failure events, kept PHI-safe on purpose.

Questions we get

Where does the call audio go? Speech recognition and synthesis run in the voice pipeline for the duration of the call. Audio is not the record; the summary and the scheduling write are.

Can we get the BAA before go-live? Yes, it is a precondition of go-live on Practice and Enterprise.

Who do we talk to about a security review? Contact us; enterprise engagements include a named contact.

Related