1. Our Role Under HIPAA
Signal AI provides its clinical intelligence platform to healthcare organizations and professionals. When a customer that is a covered entity (or another business associate) submits protected health information ("PHI") to the platform, Signal AI acts as a business associate under the Health Insurance Portability and Accountability Act ("HIPAA").
We enter into a Business Associate Agreement ("BAA") with every customer whose use of the platform involves PHI. The BAA governs our handling of PHI and controls over our general Privacy Policy and Terms of Service with respect to PHI.
2. How We Safeguard PHI
- Encryption. PHI is encrypted in transit (TLS) and at rest.
- Access controls. Access to PHI is limited by role, granted on a need-to-know basis, and protected by strong authentication.
- Audit logging. Access to PHI and every AI suggestion generated by the platform is logged, sourced, and reviewable.
- Segregation. Each customer's data is logically separated from other customers' data.
- Workforce training. Our personnel receive privacy and security training and access PHI only when necessary to support the Service.
- Risk management. We maintain a security program aligned with recognized frameworks, including periodic risk assessments and third-party testing.
PATIENT DATA IS NEVER USED TO TRAIN OUR MODELS. PHI IS PROCESSED ONLY TO PROVIDE AND SECURE THE SERVICE FOR THE CUSTOMER THAT CONTROLS IT.
3. Permitted Uses & Disclosures
Consistent with our BAAs, we use and disclose PHI only:
- To provide the Service to the customer — including analyzing results, computing trends and scores, and generating evidence-linked suggestions for the treating professionals;
- For the proper management and administration of Signal AI, as permitted by the BAA;
- To subcontractors that support the Service, and only under written agreements that impose protections at least as strict as our BAA;
- As required by law.
We do not sell PHI, and we do not use PHI for marketing or advertising.
4. Our Commitments
- We report security incidents and breaches of unsecured PHI to affected customers without unreasonable delay, and cooperate with their notification obligations;
- We support customer obligations to respond to patient requests — such as access, amendment, and accounting of disclosures — as set out in the BAA;
- We return or destroy PHI when the customer relationship ends, as directed by the customer and the BAA, unless retention is required by law;
- We make our practices available for review as reasonably required for customer compliance programs.
5. Customer Responsibilities
Healthcare organizations and professionals using the platform are responsible for:
- Obtaining any patient consents or authorizations required to submit PHI to the Service;
- Submitting only the minimum necessary PHI for the intended purpose;
- Managing their users' access and promptly deprovisioning personnel who leave;
- Exercising independent professional judgment on all outputs of the Service.
6. Information for Patients
If you are a patient, your healthcare provider — not Signal AI — controls your medical records and decides how they are used in the platform. To exercise your rights over your health information (such as requesting access or corrections), please contact your provider directly. We support providers in responding to those requests under our BAAs.
7. Contact
For HIPAA or security questions, contact our privacy team at privacy@signalingintel.com. To report a suspected security issue, contact security@signalingintel.com.