At Chartnote, the trust of clinicians and patients is our top priority. Security is at the core of everything we create. We adhere to HIPAA, PIPEDA, GDPR, and SOC 2 standards to ensure that all data we collect and process is safeguarded at every stage.
All Chartnote employees are required to:
Undergo background checks before being hired.
Complete annual security awareness training covering HIPAA, PIPEDA, GDPR, privacy, and information classification.
HIPAA, PIPEDA, and GDPR compliance: We follow globally recognized regulations to protect sensitive health and personal data.
SOC 2 certification: Demonstrates our commitment to strong internal controls for security, availability, and confidentiality.
Regular risk assessments ensure our policies remain current and relevant.
Our CTO is responsible for overseeing Privacy and Security.
All software changes undergo compliance reviews.
We use infrastructure-as-code, with all infrastructure changes reviewed before deployment.
Engineers complete secure development training to follow best practices.
All hosting services and data are stored and processed within Amazon Web Services (AWS) secure data centers.
We maintain a HIPAA Business Associate Agreement (BAA) and a Data Processing Agreement (DPA) with AWS.
Chartnote leverages AWS’ high-availability infrastructure to ensure data is always accessible.
All data is encrypted at rest and in transit using standard encryption protocols.
All vendors who may process patient information must be HIPAA, PIPEDA, and GDPR compliant.
Vendors are required to sign BAAs, DPAs, or equivalent agreements with Chartnote.
We regularly review vendor security practices to ensure ongoing compliance.
All AI models we use are HIPAA, PIPEDA, and GDPR compliant and do not retain data.
Protected health information (PHI) is never used for AI training purposes.
Patient information is encrypted at rest and in transit.
Notes and recordings are securely saved in a HIPAA, PIPEDA, GDPR, and SOC 2-compliant manner.
Users can:
Manually delete notes and recordings at any time.
Set notes and recordings to automatically delete after 1–30 days.
For more details, please refer to:
If you have further questions about Chartnote’s security or compliance practices, please reach out to our support team—we’re here to help.