A BAA on every plan
Every PsychNote plan, including solo Starter, comes with a signed business associate agreement. Your acceptance is recorded in your account.
PsychNote AI · Security
How PsychNote AI protects patient information
PsychNote handles protected health information, so we built it around HIPAA from the start. Here is exactly what that means in practice.
No recordings, ever
PsychNote transcribes the session as it happens and discards the audio, so no recording is ever stored. The transcript is kept only as long as you choose, and you can delete it.
Hosted in the United States
Clinical data is stored in a managed PostgreSQL database in a U.S. data center (Northern Virginia).
Encrypted in transit and at rest
Every connection uses TLS 1.2 or higher, and stored data is encrypted at rest with AES-256.
Each practice walled off
Row-level security is turned on for every table, so the database itself keeps each practice's patients separate.
Tamper-evident audit trail
Activity on patient records is written to an append-only audit trail. Each entry is cryptographically chained to the one before it, so any alteration would show.
Consent on record
Patient consent is captured in PsychNote, so it is documented alongside the encounter it covers.
Payments kept separate
Subscriptions are paid through Stripe. Gnosis Concepts never sees or stores card numbers.
If something goes wrong
If we discover a breach that affects your patients' information, we will notify you within 10 business days of discovery, well inside the 60-day limit HIPAA sets, and work with you on the notices you must send.
Compliance officers can request our security documentation through the contact form or at (210) 993-6756.