Security and compliance

PriorAuth Pilot is built to protect client health information and to meet the HIPAA requirements your agency already follows.

HIPAA Business Associate Agreement	Every agency accepts our BAA at sign-up. Our hosting provider also signs a BAA with us. Read the BAA before you sign up.
Encryption	All information is encrypted in transit (HTTPS) and at rest.
Data location	All data is stored in the United States.
Separate agency data	Each agency's information is kept separate and visible only to that agency's users.
Sign-in	Password sign-in, role-based access, and automatic sign-out after inactivity.
Activity log	Every view and change to a request is logged, so you can show who accessed what and when.
Backups and monitoring	Automatic daily backups and around-the-clock uptime monitoring.
AI and your data	AI drafts are a starting point that your staff review and approve. The AI runs on Amazon Bedrock inside AWS, and your data is never used to train AI models.
Your data, your control	Export your records anytime. If you cancel, you have 30 days to export before your data is deleted.
Companies that handle your data	Amazon Web Services (AWS): hosting, the database, document storage, and AI (Amazon Bedrock). Data stays in AWS data centers in the United States. Stedi: Medicaid eligibility checks. It receives only what the check needs, such as the client's name, date of birth and Medicaid ID. Notifyre and Sinch: fax delivery, only for agencies that use a fax add-on. Stripe: payments. Stripe never receives client information.
Deleting information	Draft requests and their documents can be deleted at any time. Requests that have been sent are kept as part of your agency's record. Database backups are kept for 14 days and then removed automatically.

Read our Privacy Policy and Terms of Service. Security questions? Email support@priorauthpilot.com.