ClearlyClaims is a HIPAA-compliant platform designed from the ground up to protect Protected Health Information (PHI). Here's exactly how we do it.
The Health Insurance Portability and Accountability Act (HIPAA) is a federal law enacted in 1996 that requires any organization handling Protected Health Information (PHI) to implement specific technical, physical, and administrative safeguards. PHI includes any information that can be used to identify a patient in connection with their health condition, care, or payment for care.
As a Business Associate under HIPAA, ClearlyClaims handles PHI on behalf of covered entities — primarily medical practices and healthcare organizations. This means we are legally required to sign a Business Associate Agreement (BAA) with every customer, and we do so without exception. The BAA is a contract that formally outlines how PHI is used, protected, and what happens in the event of a breach.
HIPAA violations are serious. Civil penalties range from $100 to $50,000 per violation, with an annual maximum of $1.9 million per violation category. Criminal penalties can include prison time. Beyond legal consequences, a breach of patient data can permanently damage your practice's reputation. This is why we treat compliance not as a checkbox, but as a core product feature.
Per 45 CFR § 164.312 — implemented and audited regularly
All PHI stored using AES-256 encryption. Data is unreadable without our encryption keys.
All data transmitted over TLS 1.3. No PHI ever travels unencrypted over any network.
Role-based access controls ensure users only see data they're authorized for. Two-factor authentication is required for every practice staff account.
Every access to PHI is logged with timestamp, user, and action. Logs are retained for 6 years per HIPAA requirements.
Sessions expire after 15 minutes of inactivity, protecting against unauthorized access on shared workstations.
We only store PHI as long as necessary. Clinical notes processed by AI are not retained after coding is complete.
Per 45 CFR § 164.308 — policies, training, and procedures
Signed with every customer — no exceptions
A Business Associate Agreement is a legally binding contract between a covered entity (your practice) and a business associate (ClearlyClaims) that formally defines how PHI is used, protected, and what our obligations are if a breach occurs. It is required by HIPAA any time a vendor handles PHI on your behalf.
When you sign up for any ClearlyClaims plan, a BAA is automatically executed as part of your subscription agreement. No extra steps required.
Our commitments to your patients and practice
Stripe
Payment Processing
Stripe has signed our BAA and maintains its own HIPAA compliance program. Payment data is fully isolated from PHI.
Claude via AWS Bedrock
AI Coding Engine — HIPAA Covered ✅
ClearlyClaims uses Anthropic's Claude AI model, accessed through AWS Bedrock. AWS has signed our Business Associate Agreement (BAA), covering all AI processing under HIPAA. Clinical notes are processed in real-time and not retained after coding is complete.
Amazon Web Services
Infrastructure & AI Hosting
ClearlyClaims is hosted on AWS HIPAA-eligible services under a signed BAA with Amazon. AWS Bedrock is used for all AI inference, ensuring PHI never leaves the HIPAA-covered environment.
If you believe you've discovered a security vulnerability or potential HIPAA violation, please contact us immediately. We take all reports seriously and will respond within 24 hours.
security@clearlyclaims.com