Security

1. Compliance

1.1 HIPAA

MH Scribe is designed to support practitioners' obligations under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the HITECH Act:

• Business Associate Agreements: We act as your Business Associate and sign a BAA with every practitioner who uses the Service to process PHI (our BAA is part of our Terms of Service)
• Subcontractor BAAs: Every service provider that receives PHI from us has signed a BAA with us (see Section 10)
• Safeguards: We maintain administrative, physical, and technical safeguards for electronic PHI, described below
• Breach Notification: We will notify you of any breach of unsecured PHI as required by HIPAA and our BAA (see Section 5.3)

Using MH Scribe does not by itself make a practice HIPAA compliant. Practitioners remain responsible for their own HIPAA obligations, including obtaining any patient consents required in their state.

1.2 SOC 2 Infrastructure

Our infrastructure is hosted on AWS, whose infrastructure is covered by SOC 2 Type II reports. These independent audits evaluate AWS's controls for security, availability, processing integrity, confidentiality, and privacy. MH Scribe itself has not undergone a SOC 2 audit.

1.3 State Privacy Laws

We aim to comply with applicable state privacy laws, including the California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA), state mental health records laws, and state breach notification requirements.

2. Data Encryption

2.1 Encryption in Transit

• TLS 1.2 or higher: Connections between your browser and MH Scribe, and between MH Scribe and its service providers, use HTTPS/TLS 1.2 or higher; the application connects to its database over TLS with certificate verification
• HSTS: HTTP Strict Transport Security is enabled so browsers always connect over HTTPS
• Security Headers: A Content Security Policy and anti-framing headers limit which scripts can run and prevent the app from being embedded in other sites

2.2 Encryption at Rest

• Database: Our Amazon Aurora PostgreSQL database uses AWS storage encryption (AES-256) with keys managed by AWS Key Management Service (KMS)
• Session Audio: Session audio is stored in Amazon S3 with server-side AES-256 encryption
• Backups: Database backups and snapshots are encrypted with the same keys as the database
• No Public Access: Storage buckets block all public access; audio is uploaded and retrieved through short-lived, signed URLs

2.3 Session Audio

• Audio is sent over an encrypted connection and stored encrypted in Amazon S3
• Audio is transcribed by our transcription provider (Groq), which has signed a BAA with us
• Audio files are automatically and permanently deleted from storage 30 days after upload
• Practitioners can delete a recording, or an entire session including its audio, at any time before then

3. Infrastructure Security

3.1 Cloud Infrastructure

• Data Location: Our application, database, and stored files are hosted in the AWS US West (Oregon) region
• AI in the US: AI generation runs only on Amazon Bedrock, using US-only inference profiles that keep requests within AWS US regions
• Managed Services: We run on managed AWS services (App Runner, Aurora, S3), so AWS patches the underlying servers and operating systems

3.2 Network Security

• Virtual Private Cloud (VPC): Our database runs inside a dedicated VPC
• Private Subnets: The database sits in private subnets and is not reachable from the internet
• Security Groups: Firewall rules only allow the application and our administrative access host to connect to the database
• No Open Admin Ports: Administrative database access goes through AWS Systems Manager Session Manager; the access host accepts no inbound connections

3.3 Application Security

• Code Review: Changes are made through pull requests and checked by automated tests, type checking, and linting before deployment
• Container Scanning: Container images are scanned for known vulnerabilities when pushed to our registry
• Input Validation: Server-side inputs are validated before use, and database queries are parameterized to prevent injection
• Output Encoding: React's output encoding and our Content Security Policy help prevent cross-site scripting (XSS)
• CSRF Protection: State-changing requests are protected against cross-site request forgery

4. Access Controls

4.1 Authentication

Sign-in is handled by Clerk, a dedicated authentication provider:

• Multi-Factor Authentication (MFA): MFA is available for accounts and strongly recommended
• Secure Password Storage: Passwords are never stored by MH Scribe; Clerk stores them using industry-standard password hashing
• Brute Force Protection: Repeated failed sign-in attempts are rate-limited
• Session Management: Secure, expiring session tokens

4.2 Authorization

• Single-Clinician Workspaces: Each account is a private workspace for one practitioner. Patient records are visible only to the practitioner who owns the workspace
• Workspace Isolation: Every database query is scoped to the signed-in practitioner's workspace, with no cross-workspace access
• Least Privilege: Application services are granted only the AWS permissions they need

4.3 Administrative Access

MH Scribe is operated by a small team, and access to production systems is limited to the people who run the Service:

• Production access is limited to authorized personnel
• Production is separated from development and test environments
• AWS account activity, including administrative actions, is recorded by AWS CloudTrail
• We access PHI only when necessary to operate the Service, resolve a problem, or respond to your request

5. Monitoring, Logging & Incident Response

5.1 Monitoring and Alerting

• Error Monitoring: Application errors are reported to Sentry, which alerts our team
• Infrastructure Alarms: Amazon CloudWatch alarms notify us of elevated application, API, and database errors, database load, and failing health checks

5.2 Logging

• AWS Account Activity: AWS CloudTrail records API activity in our AWS account, with log file integrity validation enabled
• Database Activity: Database logs, including statement-level audit logging (pgAudit) in production, are exported to Amazon CloudWatch
• Storage Access: Access to our audio storage bucket is recorded in S3 server access logs
• Application Logs: Application and AI-service logs are kept in Amazon CloudWatch within our AWS account, for periods that vary by log type

MH Scribe does not currently provide an in-app audit log of every view of a patient record. If you need information about access to or disclosures of specific PHI (for example, to respond to a patient's request for an accounting of disclosures), contact compliance@mhscribe.ai and we will provide what our logs support.

5.3 Incident Response and Breach Notification

If we discover a security incident affecting PHI, we will investigate, contain it, and take steps to prevent it from happening again. In the event of a breach of unsecured PHI, we will:

• Notify affected practitioners without unreasonable delay, and within the time required by our BAA and HIPAA
• Provide the information practitioners need to notify affected individuals, HHS, and (where required) the media
• Document the incident and the actions we took in response

6. Physical Security

MH Scribe does not operate its own servers or data centers. Our infrastructure runs in AWS data centers, where AWS provides physical security including:

• Access Control: Security staff, controlled entry, and multi-factor physical access
• Surveillance: Continuous video monitoring
• Environmental Controls: Fire detection and suppression, climate control, and redundant power
• Equipment Security: Secure decommissioning and destruction of storage media

AWS data center physical security controls are covered by AWS's SOC 2 Type II reports.

7. Personnel

MH Scribe is built and operated by a small team. Everyone with access to production systems is bound by confidentiality obligations covering customer data and PHI, and is expected to understand and follow HIPAA requirements.

8. Vulnerability Management

• Dependency Updates: We review and update third-party dependencies regularly and prioritize fixes for known vulnerabilities by severity
• Container Scanning: Container images are scanned for known vulnerabilities on push
• Managed Patching: AWS manages operating system and database engine patching for our managed services
• Pre-Deployment Checks: Changes pass automated tests and checks before they reach production

9. Backups & Availability

9.1 Data Backup

• Automated Backups: The production database is backed up automatically by Amazon Aurora
• Point-in-Time Recovery: The database can be restored to any point within the backup retention period
• Retention: Automated backups are retained for 7 days
• Encryption: Backups are encrypted at rest
• Deletion Protection: The production database has deletion protection enabled and takes a final snapshot if it is ever removed

9.2 Availability

• Aurora stores database data redundantly across multiple AWS Availability Zones in the US West (Oregon) region
• The application runs on AWS App Runner, which health-checks the application and replaces unhealthy instances
• We do not currently offer a contractual uptime commitment (SLA)

10. Service Providers

We use the service providers below to run MH Scribe. Every provider that receives PHI has signed a Business Associate Agreement with us, and each provider receives only the data it needs for its role.

Your data is stored in the AWS US West (Oregon) region. PHI is processed only by MH Scribe and the providers marked "Yes" above, under BAAs.

11. Security Vulnerability Reporting

We appreciate the security research community's efforts in helping keep our platform secure. If you discover a security vulnerability, please report it responsibly:

• Email: security@mhscribe.ai
• Response: We aim to acknowledge reports within two business days
• Good Faith: We will not pursue legal action against researchers acting in good faith

Please include sufficient detail for us to reproduce and validate the vulnerability. We ask that you do not publicly disclose vulnerabilities until we have had an opportunity to address them.

12. Security Contact Information

Security
For security concerns, vulnerability reports, or security-related questions:
Email: security@mhscribe.ai

Compliance & Privacy
For HIPAA, privacy, or BAA-related inquiries:
Email: compliance@mhscribe.ai