Security Practices

1. HIPAA Compliance

SutureNote is built on HIPAA-eligible AWS infrastructure. All services involved in processing or storing patient data are covered by a signed Business Associate Agreement (BAA). Patient data is processed and stored only within our HIPAA-eligible AWS environment and is not shared with third parties outside that environment. To the best of our knowledge, all user data is stored in the United States.

2. Encryption

All protected health information is encrypted in transit and at rest.

• In transit — industry-standard encryption for all network communications
• At rest — encryption applied to all stored data, including databases, file storage, and caches
• Key management — encryption keys managed via hardware security modules with automatic rotation

3. AI & PHI Protection

SutureNote uses AI models for clinical note generation and medical transcription. All AI processing runs within our HIPAA-eligible AWS environment under a signed Business Associate Agreement.

• Detected PHI is tokenized — replaced with non-identifying placeholders — before text is sent to AI models, which are designed to operate on tokenized text rather than raw patient information.
• Original values are encrypted and restored only for physician display.
• Our model providers do not use patient data to train or improve their models.

4. Access Control

SutureNote follows a zero-trust model with minimal human access to production systems.

• Multi-factor authentication (MFA) required for all accounts
• Role-based access control with principle of least privilege
• Patient data is scoped to the authenticated user — no cross-user data access
• Automated deployments with no manual production access
• Quarterly access reviews with automatic revocation of unused permissions

5. Data Management

• Audio recordings — encrypted during processing, deleted after successful note generation
• Manual deletion — clinicians may delete any patient notes at any time
• Account deletion — users can request deletion of their personal information as described in our Privacy Policy
• Secure erasure — we use cryptographic erasure (key destruction) so deleted data is rendered unreadable, including in backups

6. Security Operations

• Regular penetration testing by third-party security firms
• Automated vulnerability scanning and dependency monitoring across all components
• Critical security patches applied promptly upon identification
• Background checks and annual HIPAA training for all employees
• Documented incident response plan with breach notification procedures
• Ongoing compliance monitoring and regular risk assessments

7. Business Continuity