Our role
Moxcares operates as a HIPAA Business Associate to the healthcare clinics ("Covered Entities") that use our platform. We process Protected Health Information ("PHI") only on behalf of, and under instructions from, our Covered Entity customers — pursuant to a signed Business Associate Agreement.
Safeguards
We implement HIPAA-required administrative, technical, and physical safeguards, including:
- AES-256 encryption for PHI at rest;
- TLS 1.2+ encryption for PHI in transit;
- Multi-factor authentication for clinic users;
- Role-based clinical authority, with a stated and recorded reason for administrative chart access;
- Immutable patient-record access logs and attributed amendments to signed notes;
- Workforce HIPAA training, written policies, risk analysis and incident-response procedures;
- Automated vulnerability, dependency and secret scanning, with production release gates.
See the Trust Center for our current control summary. No system can be guaranteed 100% secure.
Subcontractors
Every vendor that handles PHI on our behalf is engaged under a Business Associate Agreement. Our dated vendor register names the vendors and their BAA status, with non-PHI services listed separately. Card credentials are stored by Stripe, not by Moxcares.
For patients
If you are a patient, please direct requests about your health information to the clinic where you received care. They control your record and we cannot disclose it without their authorization.
The clinic’s AI receptionist and text assistant identify themselves as AI. You may ask for a person, and requests outside the AI’s scope are passed to clinic staff. If you are in crisis, call or text 988. For immediate danger, call 911; the platform is not an emergency service.
Breach notification
In the event of a breach affecting PHI, we will notify the impacted Covered Entity without unreasonable delay and in accordance with the HIPAA Breach Notification Rule and the BAA.
Contact
Questions about HIPAA, BAAs, or security can be sent to security@moxcares.com.