Enterprise-ready controls, transparency, and contractual protections — built for healthcare workflows.
All data is protected using TLS/SSL for transmission and AES-256 encryption for storage.
Role-based access control (RBAC) with multi-factor authentication and minimum necessary access.
ICD-10 Coding Pro logs administrative actions (user, organization, administrative membership, single sign-on and project changes); execution and revocation of the BAA and acceptances of versioned legal agreements made through the in-product signing and consent flows; uploads and downloads of project guideline documents; and AI feature usage metadata (provider, model, token counts and timing, never message content). The Accurecord API also records PHI access in a HIPAA accounting-of-disclosures ledger that customers can export.
Documented incident response procedures, continuous automated security alerting (Azure Monitor) routed to our responder, and breach notification protocols.
Public list of our subprocessors with 30-day advance notice for changes. View subprocessors
Business Associate Agreements available for corporate customers with PHI workflows. Learn more
Accurecord AI's enterprise offering is designed to support HIPAA-regulated workflows and we offer a BAA for eligible customers. HIPAA requires business associate relationships to be governed by contracts with specific terms.
The Health Insurance Portability and Accountability Act (HIPAA) establishes national standards for protecting individuals' medical records and personal health information. When a covered entity (like a healthcare provider) works with a business associate (like Accurecord AI) that will create, receive, maintain, or transmit protected health information (PHI) on behalf of the covered entity, HIPAA requires a written Business Associate Agreement.
Microsoft explicitly notes there is no HHS "certification" standard for HIPAA compliance. Rather, HIPAA compliance is an ongoing operational commitment to implementing required safeguards and procedures. We avoid "certified HIPAA compliant" claims and instead describe our design for HIPAA workflows and our willingness to sign a BAA.
For enterprise customers: Our ICD-10 Coding Pro organization accounts and the ICD-10 Coding API are designed with HIPAA compliance considerations in mind, including encryption, access controls, audit logging, and incident response procedures. We are prepared to execute a Business Associate Agreement with eligible enterprise customers that need to process PHI.
We have not yet engaged a SOC 2 auditor, and no SOC 2 report exists. Security documentation and questionnaire answers can be provided under NDA to qualified enterprise prospects.
SOC 2 is an auditing standard developed by the American Institute of CPAs (AICPA) that evaluates organizations based on five "Trust Service Criteria": Security, Availability, Processing Integrity, Confidentiality, and Privacy. Type II reports demonstrate that an organization's controls are operating effectively over time (typically a minimum of 6 months).
Request Security Package (NDA)Accurecord AI is built on Microsoft Azure, a leading enterprise cloud platform. Microsoft states Azure offers a HIPAA Business Associate Agreement for in-scope Azure services as part of Microsoft Product Terms.
Azure's infrastructure provides physical security, network isolation, encryption, compliance certifications, and audit capabilities that support our security posture. We leverage Azure's built-in security features including Azure Active Directory, Azure Key Vault for secrets management, and Azure Monitor for logging and alerting.
Learn about Azure compliance →