> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bota.dev/llms.txt
> Use this file to discover all available pages before exploring further.
# HIPAA Compliance
> Using Bota in healthcare applications
Bota is designed to support customers building healthcare applications that handle Protected Health Information (PHI). This page describes our HIPAA compliance program and your responsibilities as a covered entity or business associate.
***
## HIPAA Overview
The Health Insurance Portability and Accountability Act (HIPAA) establishes standards for protecting sensitive patient health information. If you are a covered entity or business associate handling PHI, you must ensure your vendors also comply with HIPAA requirements.
***
## Bota's HIPAA Compliance
### Business Associate Agreement (BAA)
Bota offers a Business Associate Agreement to customers who need to process PHI through our platform. The BAA establishes:
* Bota's obligations as your business associate
* Permitted uses and disclosures of PHI
* Safeguards we implement to protect PHI
* Breach notification procedures
* Audit and compliance requirements
Contact [legal@bota.dev](mailto:legal@bota.dev) to execute a Business Associate Agreement
### Administrative Safeguards
| Safeguard | Implementation |
| ---------------------- | ------------------------------------------------------------ |
| **Security Officer** | Designated security officer responsible for HIPAA compliance |
| **Workforce Training** | All employees complete HIPAA training annually |
| **Access Management** | Role-based access controls, principle of least privilege |
| **Incident Response** | Documented procedures for security incident handling |
| **Risk Assessment** | Annual risk assessments and remediation planning |
### Physical Safeguards
| Safeguard | Implementation |
| ------------------------ | ------------------------------------------------------- |
| **Data Center Security** | AWS data centers with SOC 2 certification |
| **Access Controls** | Badge access, biometric authentication, 24/7 monitoring |
| **Workstation Security** | Encrypted devices, remote wipe capability |
| **Device Disposal** | Secure destruction of media containing PHI |
### Technical Safeguards
| Safeguard | Implementation |
| ------------------------- | --------------------------------------------------------- |
| **Encryption in Transit** | TLS 1.2+ for all API communication |
| **Encryption at Rest** | AES-256 encryption for all stored data |
| **Access Controls** | Unique user identification, automatic session timeout |
| **Audit Logging** | Comprehensive logging of all PHI access and modifications |
| **Integrity Controls** | Checksums and validation for data integrity |
| **Transmission Security** | Secure API endpoints, webhook signature verification |
***
## Your Responsibilities
As a covered entity or business associate, you are responsible for:
### Before Using Bota
Contact [legal@bota.dev](mailto:legal@bota.dev) to sign a Business Associate Agreement before processing any PHI
Determine what PHI will be processed and ensure Bota is appropriate for your needs
Set appropriate data retention policies for your project (we recommend aligning with your organization's retention requirements)
### During Operation
| Responsibility | Description |
| ---------------------- | ---------------------------------------------------------------- |
| **Patient Consent** | Obtain appropriate consent before recording patient interactions |
| **Minimum Necessary** | Only include PHI that is necessary for your use case |
| **Access Controls** | Limit API key access to authorized personnel |
| **Audit Your Logs** | Regularly review access logs for your Bota project |
| **Incident Reporting** | Report any suspected breaches immediately |
### Consent Best Practices
When using Bota to record patient-provider conversations:
1. **Inform the patient** that the conversation will be recorded
2. **Explain the purpose** — clinical documentation, quality improvement, etc.
3. **Obtain explicit consent** — verbal or written, as required by your policies
4. **Document consent** — store consent status with the recording via API metadata
5. **Honor opt-outs** — do not record patients who decline
```json theme={null}
// Example: Storing consent with a recording
{
"end_user_id": "eu_patient123",
"device_id": "dev_clinic456",
"metadata": {
"consent_obtained": true,
"consent_type": "verbal",
"consent_timestamp": "2025-01-15T10:00:00Z",
"provider_id": "dr_smith789"
}
}
```
***
## PHI in Bota
### What Constitutes PHI
Protected Health Information includes any individually identifiable health information, such as:
* Patient names and contact information
* Medical record numbers
* Diagnosis and treatment information
* Dates of service
* Audio recordings of clinical encounters
* Transcriptions containing health information
### Where PHI May Exist in Bota
| Component | PHI Potential | Notes |
| -------------------- | ------------- | -------------------------------- |
| **Audio Recordings** | High | Primary source of PHI |
| **Transcriptions** | High | Contains spoken PHI |
| **Summaries** | High | May contain clinical information |
| **EndUser Records** | Medium | Depends on external\_id usage |
| **Metadata** | Low-Medium | Depends on what you store |
### De-identification
If you want to reduce PHI exposure, consider:
* Using internal patient IDs as `external_id` rather than names
* Storing metadata references rather than PHI directly
* Implementing automated redaction in your downstream systems
***
## Data Handling
### Storage Location
All PHI is stored in AWS data centers in the United States. For customers requiring specific geographic storage, contact us about regional deployment options.
### Data Retention
Configure retention policies appropriate for your compliance requirements:
```bash theme={null}
# Example: Setting 7-year retention for clinical recordings
curl -X PATCH https://api.bota.dev/v1/projects/current \
-H "Authorization: Bearer sk_live_..." \
-H "Content-Type: application/json" \
-d '{
"settings": {
"retention_days": 2555
}
}'
```
HIPAA requires retention of medical records for 6 years from date of creation or last effective date. State laws may require longer retention.
### Data Deletion
You can delete PHI at any time via the API:
```bash theme={null}
# Delete an EndUser and all associated PHI
curl -X DELETE https://api.bota.dev/v1/end-users/eu_patient123 \
-H "Authorization: Bearer sk_live_..."
```
Deletion is permanent and includes:
* All recordings for the EndUser
* All transcriptions and summaries
* All associated metadata
***
## Breach Notification
### Our Obligations
If we discover a breach of unsecured PHI, we will:
1. Notify you within 24 hours of discovery
2. Provide details of the breach (what data, how many affected, timeline)
3. Describe our remediation actions
4. Cooperate with your investigation and notification requirements
### Your Obligations
You are responsible for:
* Notifying affected patients as required by HIPAA
* Reporting to HHS Office for Civil Rights
* Documenting the breach and response
* Implementing corrective actions
***
## Audit and Compliance
### Audit Logs
Bota maintains comprehensive audit logs for all PHI access:
* API requests (who, what, when)
* Data modifications
* Access by Bota personnel (rare, only for support with your permission)
Enterprise customers can request audit log exports.
### Compliance Certifications
| Certification | Status |
| ----------------- | -------------------- |
| **SOC 2 Type II** | Certified |
| **HIPAA** | Compliant (with BAA) |
| **GDPR** | Compliant |
### Third-Party Audits
We engage independent auditors annually to assess our security controls. Audit reports are available to customers under NDA.
***
## Frequently Asked Questions
You need a BAA only if you will process PHI through Bota. If you're using Bota for non-healthcare purposes (e.g., sales calls), a BAA is not required.
Bota employees do not access customer PHI in normal operations. Access is only possible with your explicit permission for troubleshooting specific issues, and all access is logged and audited.
Our transcription pipeline is covered under the BAA. Audio is processed in isolated environments and deleted after transcription completes. We do not use PHI to train AI models.
Bota Pin and Bota Note devices store audio locally with encryption. Data is only transmitted when synced via the mobile app over encrypted connections.
Bota is designed for in-person conversation capture. For telehealth recording, consult with your compliance team about applicable regulations beyond HIPAA.
***
## Contact
For HIPAA compliance questions or to request a BAA:
**Email:** [legal@bota.dev](mailto:legal@bota.dev)
**Subject:** HIPAA / BAA Inquiry
***
*Last updated: January 15, 2025*