Trust & Security at Accurecord
Security and compliance are foundational to how we handle Protected Health Information — not bolted on.
Accurecord handles Protected Health Information (PHI) for medical coding only on behalf of healthcare organizations, and only under a Business Associate Agreement executed with that organization. Individual ICD-10 Coding Pro accounts and free tiers do not support PHI; ICD-10 Coding Pro organization accounts may process PHI only in eligible workflows that Accurecord AI has enabled for the identified customer under the applicable executed Business Associate Agreement. Security and compliance are foundational, not bolted on.
Compliance status
| Framework | Status |
|---|---|
| HIPAA | HIPAA safeguards and BAAs available |
| SOC 2 | Not yet engaged; no SOC 2 report exists |
| Penetration test | No independent test performed yet; one is being procured |
How we protect PHI
The controls below describe the Accurecord API (api.accurecord.io). ICD-10 Coding Pro is listed separately at the end.
- Encrypted at rest — in the Accurecord API, AES-256-GCM on PHI in our owned tables; secrets in Azure Key Vault.
- Encrypted in transit — TLS 1.2+ everywhere; HSTS, strict CSP, and security headers on every response.
- Processed under signed BAAs — clinical text you send is processed by our AI model providers under signed HIPAA Business Associate Agreements, in line with HIPAA, with zero data retention and no use of your data to train models. The Accurecord API calls OpenAI directly (BAA executed 27 Jan 2026, organization-level zero data retention). Azure OpenAI Service runs with modified abuse monitoring approved by Microsoft on 7 Sep 2026: content logging is off, which we check weekly. Chart review removes SSNs, phone numbers and email addresses before extraction. Scanned chart pages are read by Azure AI Document Intelligence under the Microsoft BAA; Microsoft stores the submitted document and its analysis result for 24 hours after the analysis completes and then deletes them, so zero retention does not apply to OCR. PHI requires an organization with an executed BAA.
- BAA-gated — in the Accurecord API, PHI features are disabled until a Business Associate Agreement is signed.
- Audited — the Accurecord API records PHI access in a HIPAA Accounting-of-Disclosures ledger (45 CFR §164.528) that customers can export (CSV / FHIR AuditEvent).
- Access controlled — in the Accurecord API, per-organization tenancy, hashed API keys with tiered access, enterprise SSO (OIDC), SCIM provisioning, automatic blocking of a credential under a credential-stuffing attack, and per-IP rate limits on authentication attempts.
- ICD-10 Coding Pro — organization accounts can use PHI features only in eligible workflows enabled under the applicable executed Business Associate Agreement; saved organization cases are field-encrypted (AES-256-GCM) and require multi-factor authentication enrollment and a verified multi-factor session for reads, exports and case actions; single sign-on is OIDC. Its audit log records administrative actions (user, organization, administrative membership, single sign-on and project changes); execution and revocation of the BAA and acceptances of versioned legal agreements made through the in-product signing and consent flows; uploads and downloads of project guideline documents; and AI feature usage metadata (provider, model, token counts and timing, never message content). The disclosures ledger, SCIM provisioning and API-key controls above are Accurecord API features, not part of ICD-10 Coding Pro.
Subprocessors
Our subprocessors and their level of PHI access are listed below. See our full subprocessor list for data categories, processing regions, and each vendor's trust documentation.
| Subprocessor | Purpose | PHI access |
|---|---|---|
| Microsoft Azure | Hosting, databases, storage and backups, including enabled organization case storage and Accurecord API PHI; Azure Front Door; chart document OCR (Azure AI Document Intelligence); Microsoft-hosted AI inference (Azure OpenAI Service) and, where used, non-PHI reference-file and retrieval-index storage; transactional email (Azure Communication Services); monitoring, secrets and sign-in services. | Yes — BAA signed; PHI only in enabled covered workflows. Inference (Azure OpenAI Service): modified abuse monitoring approved by Microsoft 7 Sep 2026, so prompts and completions are not stored, have no human review and are not used for training. |
| OpenAI OpCo, LLC (direct OpenAI API) | Direct OpenAI API inference; non-PHI reference-file and retrieval-index storage where configured. | Limited — PHI only for expressly covered and enabled endpoints and configurations. Stored files and indexes have a lifecycle separate from inference. |
| Cloudflare | Authoritative DNS for all our domains; CDN and DDoS protection for the accurecord.io marketing site; Turnstile bot checks. Not in the request path of icd10codingpro.com or api.accurecord.io | No |
| Stripe | Billing | No |
| Twilio Verify | SMS one-time passcodes (account verification) | No |
| Google / Microsoft OAuth | Federated sign-in | No |
| FirstPromoter | Referral and affiliate attribution on pricing, plan-selection, signup and billing pages, where the referral program is enabled | No |
Subscribe for subprocessor-change notifications: [email protected].
Documents
- Privacy Policy · Terms of Service · DPA · SLA — accurecord.io/privacy, /terms, /dpa, /sla
- Request a BAA: [email protected]
- Request our security questionnaire answers (under NDA): [email protected]
Report a vulnerability
Email [email protected]. We acknowledge reports within 2 business days and do not pursue good-faith researchers who follow coordinated disclosure.