Protect the information.
Encryption in transit and at rest, staff MFA and role-based permissions support the protection of patient information.
Security architectureMOXCARES TRUST CENTER
Trust should be
something you can inspect.
Understand how Moxcares protects information, supervises AI-assisted work and records actions. Clear controls. Accessible policies. Specific answers.
Maintained by Moxcares. This is a product-control overview, not an independent audit report or certification. Moxcares is not SOC 2 certified today.
SECURITY IN THE WORKFLOW
Controls where the work happens.
Security is part of access, documentation, communication and the activity history—not just a badge on a page.
Keep people accountable.
Clinical proposals are reviewed by the responsible clinician. AI actions are attributable instead of appearing as an unnamed staff action.
Human-supervised AIMake the history inspectable.
Chart access and changes are logged. Append-only, hash-chained audit records and daily anchors provide tamper-evident history.
Audit controlsKnow where the data goes.
PHI-handling vendors have BAAs in place. Non-PHI vendors serve separately defined purposes, such as payments and transactional email.
Vendors & data handlingPHI HANDLING
Useful AI needs deliberate boundaries.
Patient information belongs in the appropriate clinical workflow, with controls on how it is accessed and used.
No PHI for model training.
Patient information is not used to train AI models. PHI-processing services are subject to the relevant contractual arrangements and product controls.
Notifications are not clinical conversations.
Notification links direct patients to identity-verified communication. Clinical messages and attachments belong in the secured workflow, not in general notification content.
Audio is not kept indefinitely.
Ambient source audio is purged after processing. Transcripts and resulting clinical records are distinct from the source recording and follow their applicable handling requirements.
HUMAN-SUPERVISED AI
Prepared by Mox.
Reviewed by your team.
See the difference between AI preparation and an authorized action. Clinical responsibility remains with the clinician.
What this video shows
A demonstration of Mox preparing work, the team reviewing it and the activity history recording who took action.
POLICIES & AGREEMENTS
Start with the documents.
Review the published policies, then contact us for the details your procurement or security team needs.
Business associate agreementThe agreement governing business-associate responsibilities.Security & controlsMore detail on access, encryption, audit integrity and AI boundaries.HIPAA noticeOur published HIPAA information.Privacy policyHow information is handled across our services.Terms of serviceThe terms that govern use of Moxcares.Vendors & data handlingNamed PHI-handling vendors and separately scoped services.
DUE DILIGENCE, WITHOUT THE GUESSWORK
Ask the specific question.
Need to review vendor scope, retention, incident response or access controls? Contact our team for the current information and any documents available for your review. We do not present unpublished policies as independently validated evidence.
security@moxcares.com