Skip to content
Super Genius Labs
All docs
Genius Care · 04

Security, PHI handling, and the BAA

What Genius Care does with protected health information today. Encryption, PHI minimization, audit logging, the BAA on every plan, and what is not.

Updated

Genius Care is designed for HIPAA workloads. We do not claim certifications we have not completed, so this page states what is true today and what is on the roadmap.

What is in place

  • Encryption in transit and at rest. TLS 1.3 on the wire, AES-256 for stored data.
  • PHI minimization by design. The agent does not persist conversational PHI outside the system of record it books into. The voice path records bounded latency and token metrics plus PHI-safe operational failure events (a stalled turn, a deferred write), not call content.
  • Access logging. PHI access is logged for review. Those logs are bounded on purpose. They are not a replay of every model decision (see below).
  • Prompts and configuration are versioned in the repository, so a change to what the agent says is a reviewed change, not a live edit.

The Business Associate Agreement

A signed BAA covers PHI handling, breach notification, and audit obligations. It is included on every plan, Starter through Enterprise, and it is signed before any real-PHI workload runs. Every plan runs the same pipeline: the agent looks callers up, verifies who they are, and books into your EMR, so every plan handles PHI. See Plans and call caps for the tier table.

What is not yet true

  • Genius Care is not currently SOC 2 audited. The roadmap toward formal certifications is tracked publicly on the Genius Care page.
  • We do not describe the product as "HIPAA compliant". HIPAA compliance is a property of a covered entity's whole program, and we would rather show you the controls than use the phrase.
  • Operational logs are not a complete audit trail of every model decision. They are bounded metrics and failure events, kept PHI-safe on purpose.

Questions we get

Where does the call audio go? Speech recognition and synthesis run in the voice pipeline for the duration of the call. Audio is not the record. The summary and the scheduling write are.

Can we get the BAA before go-live? Yes, it is a precondition of go-live on every plan.

Who do we talk to about a security review? Contact us. Enterprise engagements include a named contact.

Related