Arc Care is built end-to-end to meet HIPAA's Privacy, Security, and Breach Notification Rules. Every byte of PHI is encrypted, every access is logged, and every customer gets a signed Business Associate Agreement.
We sign a Business Associate Agreement (BAA) with every covered entity and downstream business associate before any PHI is exchanged. PHI is encrypted at rest and in transit, segregated by tenant, and access is restricted by role.
PHI is never used to train external or third-party AI models. Period.
Arc Care is an AI engine — never an autonomous decision-maker. Every recommendation is surfaced to a credentialed reviewer, with structured override, rationale, and citation tracking baked into the workflow and the audit log.
Yes. A signed Business Associate Agreement is a standard part of every customer engagement, executed before any PHI is shared.
PHI is stored in HIPAA-eligible, SOC 2-audited cloud infrastructure within the United States. Tenants are logically segregated.
No. PHI is never used to train external or third-party AI models, and is never shared outside your tenant boundary.
Only authorized personnel with a documented need-to-know. Access is enforced through role-based access control, MFA, and immutable audit logs.
Arc Care follows a documented incident response plan with breach notification timelines aligned to HIPAA and applicable state laws.
Request our security overview, BAA template, and compliance documentation as part of your evaluation.
Request Security Package