Protect the information.
Encryption in transit and at rest, staff MFA and role-based permissions support the protection of patient information.
Security architectureMOXCARES TRUST CENTER
Trust should be
something you can inspect.
Moxcares is your HIPAA Business Associate. We process patient information on your clinic’s behalf as permitted by the BAA, accepted before PHI enters the platform. Review the controls, policies and vendors behind that commitment.
Maintained by Moxcares. This is a product-control overview, not an independent audit report or certification. Moxcares is not SOC 2 certified today.
SECURITY IN THE WORKFLOW
Controls where the work happens.
Security is part of access, documentation, communication and the activity history—not just a badge on a page.
Keep people accountable.
Clinical proposals are reviewed by the responsible clinician. AI actions are attributable instead of appearing as an unnamed staff action.
Human-supervised AIMake the history inspectable.
Chart access and changes are logged. Append-only, hash-chained audit records and daily anchors provide tamper-evident history.
Audit controlsKnow where the data goes.
PHI-handling vendors have BAAs in place. Non-PHI vendors serve separately defined purposes, such as payments and transactional email.
Vendors & data handlingPHI HANDLING
Useful AI needs deliberate boundaries.
Patient information belongs in the appropriate clinical workflow, with controls on how it is accessed and used.
No PHI for model training.
Patient information is not used to train AI models. PHI-processing services are subject to the relevant contractual arrangements and product controls.
Notifications are not clinical conversations.
Notification links direct patients to identity-verified communication. Clinical messages and attachments belong in the secured workflow, not in general notification content.
Audio is not kept indefinitely.
Ambient source audio is purged after processing. Transcripts and resulting clinical records are distinct from the source recording and follow their applicable handling requirements.
CONTROLS, IN PLAIN LANGUAGE
How the safeguards fit together.
A practical summary of our administrative, technical and physical controls. Policy materials are available for security review under NDA.
Administrative safeguards
A named Privacy & Security Officer; written policies, risk analysis and incident-response procedures; workforce training, access reviews and vendor BAAs.
Access by authority
MFA for clinic users. Clinical designations separate chart work from operations and billing. An owner or admin without clinical authority must provide a recorded reason for administrative chart access.
An attributable record
Patient-record access is logged. Signed notes are immutable; amendments are additive and attributed. Audit records are append-only and chart access logs can be requested for compliance review.
Data protection
TLS 1.2+ in transit and AES-256 at rest. Backups support point-in-time recovery and tested restoration. Application logs exclude clinical text, transcripts and audio.
Application safeguards
Secret scanning, dependency and vulnerability checks, release gates, rate limiting and abuse controls. Internal administration is identity-gated and limited to authorized staff.
Physical safeguards
US Google Cloud infrastructure under BAA. Workforce access is through controlled systems, without local PHI copies on employee devices. Cloud-provider attestations are the provider’s—not a Moxcares certification.
ROLES & CLINICAL DESIGNATIONS
Access follows the work—not just a job title.
Clinics assign roles and designations within their permitted scope. The summary describes distinct authorities; one person may hold more than one designation.
No role permits editing another clinician’s signed note. Location and reporting permissions remain scoped to the user’s authorization.
Owner / administrator
Clinic operations, settings, staff permissions and record export. Clinical chart access without a clinical designation requires a recorded administrative reason.
Front-desk staff
Scheduling, demographics, consent-aware messaging and payment collection. A staff role alone does not grant clinical chart access.
Clinical assistant
Chart access, vitals, intake, and draft notes or prescriptions for clinician review. No authority to sign clinical notes or send prescriptions.
Billing designation
Claims preparation, submission and the revenue queue. Billing access is separate from clinical chart authority.
Practitioner / provider
Practitioners review and sign their own notes. Provider designation identifies practitioners who render billed services.
Prescriber
Prescription signing and transmission by an appropriately designated practitioner. Controlled-substance prescribing also requires identity proofing and two-factor signing.
AI, FEATURE BY FEATURE
Useful automation. Explicit limits.
Clinical work stays reviewable. Administrative automation operates within clinic rules and permissions.
| Feature | Purpose | Human oversight & limits |
|---|---|---|
| Conversational intake | Clinic questions in plain language; answers attributed to the patient or caregiver. | Clinician reviews the intake; no diagnosis or clinical advice. |
| AI receptionist | Identifies itself, books appointments, offers callbacks or waitlist places, and handles administrative questions. | Requests outside its scope go to staff; no prescribing or payment collection. |
| Mox — AI staff | Scheduling confirmations, reminders, recalls and rebooking under clinic rules, patient consent and quiet hours. | Staff supervise outreach and exceptions; no clinical decision-making. |
| Ambient scribing | Consented conversation becomes a note draft; source audio is purged after processing. | The clinician reviews, edits and signs. Optional paid add-on. |
| Coding Companion | Optional code proposals cited to the clinician’s documentation. | No inferred diagnosis or automatic code application; clinician acceptance required. |
| Ask the Chart | Answers from the patient record with source citations. | Clinician verifies context and interpretation. |
| Clinical scores | Published instruments calculated from stated inputs. | Offered, not automatically run; clinician chooses and interprets. |
| Care Pack attention rules | Rule-based, cited work items for follow-up, screening or outstanding work. | An assigned person reviews the next step; no autonomous clinical orders. |
Conversational intake
Clinic questions in plain language; answers attributed to the patient or caregiver.
Human oversight: Clinician reviews the intake; no diagnosis or clinical advice.
AI receptionist
Identifies itself, books appointments, offers callbacks or waitlist places, and handles administrative questions.
Human oversight: Requests outside its scope go to staff; no prescribing or payment collection.
Mox — AI staff
Scheduling confirmations, reminders, recalls and rebooking under clinic rules, patient consent and quiet hours.
Human oversight: Staff supervise outreach and exceptions; no clinical decision-making.
Ambient scribing
Consented conversation becomes a note draft; source audio is purged after processing.
Human oversight: The clinician reviews, edits and signs. Optional paid add-on.
Coding Companion
Optional code proposals cited to the clinician’s documentation.
Human oversight: No inferred diagnosis or automatic code application; clinician acceptance required.
Ask the Chart
Answers from the patient record with source citations.
Human oversight: Clinician verifies context and interpretation.
Clinical scores
Published instruments calculated from stated inputs.
Human oversight: Offered, not automatically run; clinician chooses and interprets.
Care Pack attention rules
Rule-based, cited work items for follow-up, screening or outstanding work.
Human oversight: An assigned person reviews the next step; no autonomous clinical orders.
Rule-based crisis-language checks on supported phone, text and chat workflows can provide 988 resources and alert the clinic. They do not guarantee detection or replace clinical assessment or emergency services. Call 911 for immediate danger.
VENDORS & BAAs
Know who is in the workflow.
Named PHI-handling vendors under BAA, with non-PHI services listed separately. Last reviewed: September 2026.
Open the vendor register →PHI-handling vendors
Business Associate Agreements in place
| Vendor | BAA |
|---|---|
| Google Cloud Platform | In place |
| In place | |
| Anthropic | In place |
| Twilio | In place |
| Stedi | In place |
| Documo | In place |
| MDToolbox | In place |
Non-PHI services
Outside the PHI-handling scope
| Vendor | BAA |
|---|---|
| Stripe | Not applicable |
| Firebase Authentication (Google) | Not applicable |
| Postmark | Not applicable |
RETENTION & RESPONSE
Defined handling. A clear point of contact.
Keep the record. Minimize transient data.
Clinical records are retained for seven years after the subscription ends, or longer where applicable law requires. Raw eligibility responses are purged after 90 days; the coverage summary remains. Call and visit audio is purged after processing; retained transcripts and notes are distinct records.
Read the retention policy →Export and continued protection.
Clinics may request C-CDA records and documents. BAA protections continue for retained PHI, including where backup destruction is infeasible. Seven years is our stated policy—not a universal HIPAA medical-record retention requirement.
If an incident occurs.
We investigate, contain and document incidents, and notify affected clinics under the BAA: without unreasonable delay and no later than 30 days after discovery for reportable events covered by Section 4.
Read the notification commitment →HUMAN-SUPERVISED AI
Prepared by Mox.
Reviewed by your team.
See the difference between AI preparation and an authorized action. Clinical responsibility remains with the clinician.
What this video shows
A demonstration of Mox preparing work, the team reviewing it and the activity history recording who took action.
POLICIES & AGREEMENTS
Start with the documents.
Review the published policies, then contact us for the details your procurement or security team needs.
Business associate agreementThe agreement governing business-associate responsibilities.Security & controlsMore detail on access, encryption, audit integrity and AI boundaries.HIPAA noticeOur published HIPAA information.Privacy policyHow information is handled across our services.Terms of serviceThe terms that govern use of Moxcares.AcknowledgementsClinical content credits and third-party software notices.Vendors & data handlingNamed PHI-handling vendors and separately scoped services.
DUE DILIGENCE, WITHOUT THE GUESSWORK
Ask the specific question.
Request a countersigned BAA, a security questionnaire response or your clinic’s chart-access log. Policy materials, risk-analysis summaries and incident-response procedures are available for customers and prospects under NDA. Contact our security team to arrange the review.
security@moxcares.comKeep reading
Blog
AI medical scribe privacy: why we delete the audio
The recording exists only while it's being processed. Then it's gone.
Blog
Why bolting AI onto old software doesn't work
What an AI-native platform looks like when it's designed for agents from day one.
Blog
AI medical scribe pricing: what small practices actually pay
Compare pricing models, chart handoff and our $69 per-provider scribe add-on across clinics.