HIPAA Notice

1. Business Associate role

When a covered entity uses VeloComms to create, receive, maintain, or transmit protected health information (PHI), Velozent Technologies acts as a Business Associate. A signed Business Associate Agreement (BAA) governs that relationship and takes precedence over general marketing statements on this site. PHI should not be processed in VeloComms until a BAA is in place.

2. Administrative safeguards

• Role-based and attribute-based access control so users only reach what their role permits.
• Immutable audit logging of security-relevant actions across every module.
• Configurable retention, legal hold, and eDiscovery to support investigations and compliance.
• Least-privilege administration with a separate platform-admin boundary between organizations.

3. Technical safeguards

• Encryption of data in transit (TLS) and encryption of stored attachments at rest.
• Multi-factor authentication and single sign-on via your identity provider.
• An AI PHI guardian that flags likely PHI in messages to support your handling policies.
• Strict tenant isolation so one organization's data is not accessible to another.

4. Physical and operational safeguards

Production infrastructure is operated under access controls and monitoring. Operational procedures cover change management, backup, and incident response. Specific hosting arrangements and subprocessors are described in the BAA and accompanying security documentation.

5. Minimum necessary and PHI in AI

VeloComms encourages a minimum-necessary approach: PHI is shared in patient-context rooms with the people involved in care, and AI features operate on your own content under governance controls with human approval for governed actions. Your organization decides which AI features are enabled.

6. Breach notification

In the event of a breach of unsecured PHI, Velozent will cooperate with the affected covered entity and provide the information needed for the covered entity to meet its notification obligations, as set out in the BAA.

7. Your responsibilities

HIPAA compliance is shared. Your organization is responsible for its own risk assessment, workforce training, access decisions, retention configuration, and appropriate use of the platform, including deciding when PHI may be entered.

8. Requesting a BAA

Covered entities and business associates can request a Business Associate Agreement and current security documentation using the contact details on this site.