Security
Security and HIPAA
CuraVoice answers patient calls, so it handles protected health information on every one of them. This page says plainly what we have in place and what we do not have yet.
Agreements
- BAA on every engagement. A Business Associate Agreement is part of every customer contract.
- Subprocessors. The vendors that process call audio and transcripts on our behalf are listed for customers during security review, along with the agreement we hold with each.
Infrastructure
- Hosting. The platform runs on Google Cloud in United States regions.
- Encryption. Data is encrypted in transit with TLS and at rest with AES-256.
- Backups. The production database has point-in-time recovery and scheduled daily and weekly backups, with delete protection switched on.
- Monitoring. Uptime is checked every minute from several regions, and alerts fire on outages, on error spikes, and on security-relevant changes such as access-policy edits.
Access
- Signed-in dashboard. Your team reviews calls, transcripts and reports through a dashboard that requires sign-in, and API requests without a valid session are rejected.
- Audit logging. Administrative actions and data access on the systems that hold call data are logged.
On the call itself
- The AI identifies itself as an AI assistant at the start of every call.
- No disclosure to third parties. When an insurance company or other third party calls about a patient, the agent confirms nothing and connects the caller to staff.
- System errors are never read to callers. Error messages from connected systems can contain another patient's details, so the agent never repeats them.
What we do not have yet
We do not hold a SOC 2 report. An audit is in progress, starting with Type 1. If your organisation needs a completed SOC 2 Type 2 report before contracting, we are not there yet and we will tell you so on the first call.
Common questions
Will CuraVoice sign a Business Associate Agreement?
Yes. A BAA is part of every customer agreement. We do not handle patient calls for anyone without one.
Is CuraVoice SOC 2 certified?
Not yet. A SOC 2 audit is in progress, starting with a Type 1 report. Our infrastructure provider, Google Cloud, is SOC 2 audited, but that is their report, not ours, and we will not present it as ours.
Is CuraVoice HIPAA certified?
No vendor is. HIPAA has no certification programme; the U.S. Department of Health and Human Services does not endorse or recognise one. What a vendor can do is sign a BAA, implement the safeguards the Security Rule requires, and show you evidence of them. That is what we do.
Are calls recorded?
Yes. Calls are recorded and transcribed so that your team can review them and so that we can check the agent is behaving correctly. Your team reviews them through a dashboard that requires sign-in.
Running a security review?
Send us your questionnaire. We answer them ourselves, and we would rather lose a deal than overstate a control.
hello@curavoice.ai