Built compliance-first, by design.
Healthcare runs on trust. Our agents are built to protect sensitive data, keep people in control, and leave a clear record, from day one.
HIPAA & protected health information
When we build agents that touch protected health information (PHI), we operate as a Business Associate. We sign a Business Associate Agreement (BAA) before any PHI is involved, and we handle that data in line with the HIPAA Privacy and Security Rules. PHI is accessed on a least-privilege basis, limited to what a workflow actually needs.
A human approves what matters
Every SimersonAi agent is designed to keep a person in the loop. Agents handle the volume, the gathering, drafting, routing, and follow-up, but a qualified person reviews and approves anything consequential before it goes out the door. Our agents do not make final clinical, coverage, or admission decisions on their own.
Secure infrastructure
- Built on HIPAA-eligible cloud infrastructure (Microsoft Azure) covered by a BAA.
- Data encrypted in transit and at rest.
- Role-based access controls and least-privilege permissions.
- Secure, tamper-resistant storage for records that must be preserved.
- Monitoring and logging of system activity.
A clear audit trail
Agents log what they did and when, so there is a record of every step. That audit trail supports accountability, quality review, and the documentation expectations that come with regulated work.
Responsible AI
We disclose the use of AI where people interact with it, including patient- and family-facing workflows, consistent with applicable AI transparency requirements. During development we use de-identified or test data wherever possible, and we never route PHI through tools that are not covered by appropriate agreements.
Questions from your compliance team?
We welcome them, and we are happy to walk your security or compliance stakeholders through how an agent handles data before anything goes live. Reach us at info@simersonai.com or (760) 465-7500.
This page describes our general approach to security and compliance and is provided for information only; it is not a warranty or a substitute for the specific terms of a signed agreement or BAA.