Security and trust, HIPAA
HIPAA, and how wai protects your practice's patient data
wai is designed for practices covered by HIPAA and signs a business associate agreement with your practice before anything goes live. Patient data is encrypted, access is enforced by role in the database, and every read of a record is logged against a named account.
Updated .
Where wai stands today
- Business associate agreement
- Signed with your practice before anything goes live.
- HIPAA readiness
- HIPAA has no certification, so readiness depends on your practice's role, the signed agreements and your operating controls.
- Encryption
- AES-256 at rest and TLS 1.3 in transit.
- Audit trail
- Every read of a record logged against a named account.
What HIPAA asks of a practice and its vendors
HIPAA applies to covered entities, most US medical practices among them, and to the business associates that create, receive, keep or send protected health information on their behalf.1 A practice may share that information with a vendor only under a written business associate agreement that sets out what the vendor may do with it and how it is safeguarded.2
The Security Rule asks for administrative safeguards such as a risk analysis and workforce access management,3 and technical safeguards including access control, audit controls and transmission security.4 There is no HIPAA certification. A practice shows compliance through its agreements, its controls and how it uses its systems.
What wai does
- 01
Signs a business associate agreement with your practice before anything goes live.
- 02
Encrypts data with AES-256 at rest and TLS 1.3 in transit, on a managed key estate.
- 03
Enforces role-based, least-privilege access in the database, and logs every read of a record against a named account.
- 04
Writes every message, draft, approval and signature to an event log your practice can export.
- 05
Holds every AI draft until a clinician signs it, so nothing clinical reaches a patient without a named person's decision.
What stays with your organisation
- Your own risk analysis, policies and workforce training.
- Who in your practice holds which role, and reviewing access when people join, move or leave.
- Patient notice and consent for recorded or transcribed consultations, under your state's rules.
The agreements we sign
As of 16 October 2026, wai acts as processor for UK and EU clinics under a written data-processing agreement, and signs a business associate agreement with US practices before go-live. We send the evidence for your intended use in writing, each item with a status and a date.
Questions
Is wai HIPAA compliant?
wai is designed for practices covered by HIPAA and signs a business associate agreement before anything goes live. HIPAA has no certification, so readiness for your practice also depends on your role, the signed agreements and your operating controls.
When is the business associate agreement signed?
Before go-live, and before any patient data reaches wai.
Does wai train AI models on our patients' data?
Patient data is processed to do the work your practice asks for, under the agreement, and is not sold. Ask us for the detail of the models and subprocessors for your intended use.
Further reading
Security and trust- Read nextSOC 2 questions
- Read nextWhere your data is stored
- Read nextIs an AI medical scribe HIPAA compliant?
- Read nextJoint Commission accreditation
- SecurityUK GDPR, and how wai handles your clinic's patient data
- SecurityThe NHS DSPT, and how wai supports your assurance
- SecurityData residency, and where wai keeps your clinic's records
- SecuritySOC 2 Type II, and the controls behind it
Bring your security questions to a demo.
A 15 minute video call on your own clinic, with your HIPAA questions answered in writing afterwards, control by control. Prices for clinics, groups and hospitals are on the pricing page.