How AudiVault protects patient health information and supports your compliance obligations
As a platform that handles Protected Health Information (PHI) including audiometric test results, patient demographics, and physician correspondence, AudiVault takes HIPAA compliance seriously. It's not an afterthought — it's foundational to how we build and operate the platform.
AudiVault operates as a Business Associate under HIPAA when processing PHI on behalf of Covered Entities. We execute Business Associate Agreements (BAAs) with all customers and maintain a comprehensive compliance program that meets or exceeds HIPAA requirements.
We provide Business Associate Agreements to all customers at no additional cost
Our infrastructure and processes are independently audited annually
AES-256 at rest and TLS 1.2+ in transit for all PHI
AudiVault implements all three categories of safeguards required by the HIPAA Security Rule
Types of Protected Health Information handled within the AudiVault platform
In the unlikely event of a security breach involving PHI, AudiVault follows the HIPAA Breach Notification Rule (45 CFR 164.400-414):
Our incident response team investigates and contains the breach within hours of detection
We perform a thorough risk assessment to determine the nature and scope of the breach
Affected customers are notified without unreasonable delay, and no later than 60 days after discovery
Root cause analysis and implementation of measures to prevent recurrence
Common questions about our compliance program
Yes. We provide our standard BAA during the onboarding process. If you need to review it before committing, contact our sales team at contact us and we'll share it with you.
All data is stored in AWS data centers located in the United States, across multiple availability zones for redundancy. We do not store or process data outside the US.
Access to customer PHI is limited to authorized support personnel on a need-to-know basis, and all access is logged. Our engineering team uses de-identified data for development and testing.
All AudiVault employees complete HIPAA training upon hire and annually thereafter. Role-specific training is provided for employees who may have access to PHI.
Yes. We share our SOC 2 Type II report under NDA with current and prospective customers. Contact our sales team to request a copy.
Schedule a demo to see how AudiVault protects your patients' data while simplifying your workflow.