HIPAA Compliance

1. Our Commitment

Consult Engine is designed with healthcare compliance at its core. We understand that clinics using our platform handle Protected Health Information (PHI), and we’ve built our infrastructure and processes to support HIPAA-compliant workflows. As a service provider to covered entities (clinics), Consult Engine acts as a Business Associate under HIPAA.

This page describes product safeguards and shared responsibilities; it is not a certification. A clinic may use live PHI only after the applicable agreements, production configuration, vendor approvals, and operating procedures are verified.

2. Business Associate Agreement (BAA)

Consult Engine provides a signed Business Associate Agreement to all clinics on eligible plans. The BAA establishes our obligations regarding PHI, including:

• Restrictions on PHI use and disclosure to the minimum necessary for providing the Service.
• Implementation of appropriate administrative, physical, and technical safeguards.
• Breach notification procedures within required timeframes.
• Return or destruction of PHI upon contract termination.
• Requirements that any subcontractors (sub-processors) agree to equivalent protections.

Clinic administrators sign the BAA directly in the dashboard under Admin, Compliance. We countersign it and email both parties the executed copy. For a negotiated agreement or your own required BAA language, contact compliance@consultengine.com.

3. Technical Safeguards

3.1 Encryption

• In transit: All data transmitted over HTTPS/TLS 1.2+.
• At rest: Sensitive integration credentials (API keys, webhook secrets) encrypted using AES-256-GCM with a dedicated encryption key.
• Database: Hosted on managed cloud database infrastructure with encryption at rest.

3.2 Access Controls

• Authentication: Admin access protected by bcrypt-hashed passwords and JWT session tokens stored as HttpOnly cookies.
• Tenant isolation: PHI repositories and routes require a clinic scope, with database row-level policies providing defense in depth when the constrained runtime role is deployed.
• Route protection: Middleware enforces authentication on all admin routes.
• API security: Rate limiting (sliding window), origin allowlists for embed endpoints, and webhook signature verification for all inbound integrations.

3.3 Audit Controls

• Audit logging: Covered PHI workflows record create, read, update, delete, export, authentication, and control events in an append-only audit trail. Audit persistence is monitored as an operational control.
• PHI-safe logging: System logs automatically redact email addresses, phone numbers, and image data URLs to prevent accidental PHI exposure in operational logs.

3.4 Data Integrity

• Input validation and sanitization on all user-submitted data (control character stripping, length enforcement, format validation).
• Image validation (resolution, face detection, size limits) before AI processing.
• Webhook signature verification for inbound integration and payment events.

4. Administrative Safeguards

• Minimum necessary data: Public lead flows collect only the contact data and treatment preference needed for the selected workflow. Chairside case records and consented media are accessible only to the clinic’s authorized staff and are not used as a clinical record system.
• Data retention policies: Configurable, legal-hold-aware retention jobs support separate windows for leads, calls, appointments, reviews, follow-ups, forms, verification records, and private case media.
• Privacy requests: Export and erasure tools help a clinic respond to lawful requests under its record-retention and legal obligations; HIPAA does not create a general right to erase a medical record.
• Workforce controls: Consult Engine and each clinic are responsible for role-appropriate access, training, sanctions, and documented access reviews for their respective workforce.
• Incident response: Suspected PHI incidents require immediate containment, documented risk assessment, and notification under the executed BAA and applicable law.

5. PHI Data Flow

Understanding where patient data moves through the platform:

5.1 Facial Imagery (Biometric PHI)

• Captured in the patient’s browser via camera or photo upload.
• Processed in-browser, on-device for face landmark detection.
• Transmitted to the configured AI image-processing provider under applicable data-handling terms.
• Optionally transmitted to a video-processing provider for image-to-video generation when enabled.
• Public visualizer imagery is not retained. It is cleared from browser memory after the session. A Chairside preview or Final Result is retained only after separate case-specific consent, in private access-controlled storage with retention, legal-hold, and deletion controls.

5.2 Contact Information

• Submitted voluntarily by the patient via the lead capture form.
• Stored in our managed database (encrypted at the infrastructure level).
• Synced to the clinic’s connected CRM when configured.
• Used by a connected scheduling system for appointment booking when configured.
• Accessible to the clinic administrator via the admin dashboard.

5.3 Call Data

• AI Receptionist calls are facilitated by a configured voice-automation provider.
• Call summaries and transcripts stored in our database with retention limits.
• Audio recordings are retained by the configured voice-automation provider according to applicable contract and retention terms.

6. Sub-Processor Management

All third-party vendors that receive or process PHI are required to sign Business Associate Agreements. Our current sub-processors:

7. Patient Rights

We support clinics in fulfilling patient rights under HIPAA:

• Right of access: Export tools help clinics respond to patient requests. Requests sent to Consult Engine are handled under the clinic’s instructions and the applicable agreement.
• Retention and erasure: The platform can locate and erase supported records when the clinic determines deletion is lawful and no retention duty or legal hold applies.
• Right to amend: Patients can request corrections through the clinic administrator.
• Disclosure support: Audit and integration records help the clinic evaluate and prepare any accounting required by law; an operational access log is not itself a legal accounting determination.

8. Client-Side Security

• Consent before capture: Granular consent modal with per-scope permissions (camera, data processing, AI generation) recorded with timestamp and version.
• Session cleanup: Patient imagery and session data are cleared from browser memory and storage after each interaction.
• No persistent client storage: Patient PHI is not stored in localStorage, sessionStorage, or IndexedDB.

9. Breach Notification

In the event of a security incident involving PHI, Consult Engine will:

• Notify affected clinics (covered entities) within 30 days of discovery.
• Provide details of the nature of the breach, types of information involved, and steps taken.
• Cooperate with clinics in fulfilling their notification obligations to affected individuals and HHS.
• Document the incident and remediation steps in accordance with HIPAA requirements.

10. Shared Responsibility

HIPAA compliance is a shared responsibility between Consult Engine and the clinics we serve:

11. Contact

For HIPAA-related inquiries, BAA requests, or to report a security concern:

• Email: compliance@consultengine.com
• Subject line: “HIPAA Inquiry” or “Security Report”