HIPAA & Security
Medical Observer keeps its recordings on a device in your clinic, and its AI runs on that device. Below are answers to common privacy and security questions.
The short answers
| Where are recordings kept? | On the device's encrypted drive, in your clinic. Nowhere else, except a staff-only conversation you choose to share (item 5 below). |
|---|---|
| Does anything leave the device? | No audio of a patient ever leaves. Six things are listed below: the first is always sent, the others only if you set them up, and the sixth is not built yet. |
| Can Golden Observer see or hear your recordings? | Not on the device: our only access to it cannot open a recording. We hear only staff-only conversations you choose to send (item 5 below). |
| Do you sell data? | No. |
| Is it encrypted? | Yes, with AES-256 (LUKS2). The key is on the device's memory card, so the drive cannot be read if it is removed on its own. If the whole device is stolen, the encryption does not protect it, but the device still asks for a PIN before it shows anything it recorded, and repeated wrong guesses lock it. |
| Who can open it? | Only staff you give a PIN. Each person's PIN opens only the screens their role needs: a nurse's PIN, for example, cannot open the front desk's transcripts. The screen locks itself after 5 minutes without use, or after up to 10 minutes if you choose. |
| Is access recorded? | Yes. Every sign-in, with the phone, computer or screen it came from, and every view, setting change and update. The record stays on the device for six years. |
| Will you sign a BAA? | Yes, before the device is installed. |
| Do subcontractors get patient information? | No. None of ours does. |
| How fast will you tell us about a breach? | Without unreasonable delay, and no later than 60 days after we discover it, as HIPAA requires. |
| How long are recordings kept? | Until you delete them, or on a schedule you set. One button deletes everything heard so far. |
| What happens when service ends? | We erase the device at your clinic and give you a certificate of erasure. |
| Do you hold certifications? | No. We hold no SOC 2 or HITRUST report. What you can check is on the device and in the documents below. |
What leaves the device?
- Device status and software version. No recorded content.
- An email when its network address changes, once you give the device an email address. It goes to you through our server, or through your clinic's own email account if you choose. It carries the device's name and serial number, your clinic's name, the device's network addresses with each Wi-Fi network's name, and the screen's port. Nothing the device recorded.
- Alerts, if you set them up, through your clinic's own email account, never ours.
- Training mode, off until the practice owner turns it on. A front-desk device sends us one text report a day, from which the device has removed names, dates, phone numbers, addresses and the other identifiers it finds, with speakers shown only as staff or visitor. A report in which it still finds an identifier is held back. With each report go the corrections, labels and notes your staff made to those conversations, and the device's name and serial number. Your owner and privacy officer can read each report exactly as it was sent, on the device's Privacy page.
- Listen and correct, also off until the practice owner turns it on. A conversation the owner or privacy officer has played in full and marked "staff only, no patient heard or talked about" comes to us with its audio, if training mode is on and its words hold no name, date, number or address. Otherwise it stays on the device, as does every conversation marked as having a patient in it.
- Leak Finder totals, only if you tick that box on your order form. This is not built yet, and nothing is sent until it is. When it is, for the first 90 days, your clinic's system sends us its leak totals: counts and dollar amounts, with no names, recordings or transcripts. We use them only to check the Leak Finder guarantee. If you question a total, we go through the line items together, on your screen.
Training mode and Listen and correct are off unless the practice owner turns them on. A patient-room device sends no reports and no conversations. What you share reaches our server over an encrypted connection. We use it only to train and improve Medical Observer, for example how well it transcribes and summarizes a clinic's day and its reports on callbacks, workload and workflow. We never sell it, and we delete any conversation you withdraw (User Agreement §5).
How do you reach the device?
After a device ships, we have one restricted key, not a login. It can check the device's health, read its update log, install an update we have signed, restart its listening, or go back to the previous version. When your clinic presses Allow remote help on the device, the key can also restart other parts of the device, or the whole device, for the 15 minutes, 1 hour or 4 hours your clinic chooses. It closes by itself when that time is up. None of this returns anything the device recorded.
Updates install outside your office hours, except in an emergency. Each one runs for 24 hours on our own device first, except an emergency fix, and each one is recorded on yours.
How does the AI improve without patient recordings?
The speech model, the part of the AI that turns speech into text, is trained on recordings of simulated clinic visits made for research, and on what clinics share in training mode. Corrections to a conversation with a patient in it stay on your device. Each new version runs for a day on our own device before we send it, and your device keeps it only if every check that passed before still passes.
What does your clinic need to do?
- Add one sentence to your Notice of Privacy Practices or intake form, and one line to your staff handbook. We give you both.
- In Illinois, Texas and Washington, get each staff member's written consent before the device learns their voice. We give you the form.
- Add the device to your risk analysis. We give you a ready-made section.
- Before you turn on Listen and correct with training mode, add to your staff notice that staff-only conversations may be shared with us to improve the product, and in Illinois, Texas and Washington get each staff member's consent first (User Agreement 7.2 and 8.3).
- Give PINs only to staff who need them, and remove a person's PIN when they leave.
Recording the front desk to run the practice is health care operations under HIPAA (45 CFR 164.506). Some states have stricter recording or biometric laws, so your counsel should confirm the notice wording for your state.
Documents and contact
We give you the BAA, the order form, the notice sentence and handbook line, the staff voice consent form and the risk-analysis section. Ask for any of them, or report a suspected security incident, at [email protected]. Please leave patient information out of the email.
Medical Observer is an operations tool. It is not a medical device, is not used for diagnosis or treatment, and is not part of any patient's medical record.