Storage and encryption
Visit audio, transcripts and notes are stored in private storage on Amazon Web Services in the United States (US East, Ohio). Nothing is public.
- Data is encrypted at rest with keys managed in AWS Key Management Service, and encrypted in transit with TLS.
- Our databases keep point-in-time recovery and are protected against accidental deletion.
- Recordings are uploaded straight to private storage with short-lived, single-purpose links.
Who can see what
Access follows a person's role in their practice. The server checks the role on every request.
| Role | What they can do |
|---|---|
| Provider | Records visits, writes notes and letters, and sees their own patients. |
| Practice administrator | Manages the practice's people and settings and sees review feedback. |
| Staff | Reads patient lists and notes, imports schedules and sends review texts. Staff never record visits or write notes. |
| MedBriefly team | Sets up practices, note formats and EMR connections. Access by our team is limited and logged. |
People sign in with Google, Microsoft or email and password. Practices can turn on authenticator-app multi-factor sign-in, and sessions end after 30 minutes without activity.
Audit logs
The server, never the browser, writes an audit entry for every view of patient information, every edit, and every send to an EMR, fax or text. Entries use opaque ids rather than patient names, so the log itself does not expose patient information. Practice administrators can review their practice's activity by month.
How AI is used
- Transcription runs on our own servers on AWS, using an open speech-recognition model. Audio is not sent to a third-party transcription service.
- Note writing uses Anthropic's Claude models through Amazon Bedrock. AWS states that Bedrock does not use customer content to train models.
- Diagnosis codes use Amazon Comprehend Medical to find candidate ICD-10-CM codes, then Claude chooses only among them. Any code that is not on the candidate list is discarded.
- Patient data is never used by us to train models.
AI output is a draft. MedBriefly flags unclear words, writes "Not discussed" instead of guessing, and requires a clinician to read and approve notes and confirm codes before anything is sent to an EMR.
HIPAA and the Business Associate Agreement
MedBriefly handles protected health information on behalf of medical practices, so we operate as a business associate. We use only HIPAA-eligible AWS services for patient information, under our Business Associate Agreement with AWS, and a Business Associate Agreement is available to every practice.
There is no government HIPAA certification for software, and we do not claim one. HIPAA compliance is shared: we provide the technical safeguards, and your practice remains responsible for how it uses them, for example by confirming patient consent before text messages are sent.
Services we rely on
- Amazon Web Services for hosting, storage, databases, sign-in, and the AI services above.
- Telnyx to deliver review text messages. Review texts contain no health information.
- Google and Microsoft only as optional sign-in providers.
Questions
Security questionnaire, BAA or a technical question? Tell us who you are and we will reply within one business day. Please do not send patient information through this website.