HIPAA, Business Associate Agreements and PHI
Radiology groups evaluating AI reporting tools ask the same three questions: where does the data go, who has signed what, and does the product need patient identifiers at all. This page answers them plainly. It describes the architecture and agreements as they are; it is not legal advice, and your compliance officer should review it against your own policies.
The short version
- GigHz Precision AI runs in a HIPAA-eligible AWS environment under a signed Business Associate Agreement between GigHz LLC and Amazon Web Services, with encryption in transit and at rest.
- Dictation audio and report text are processed through OpenAI's API services under agreements covering that processing; content sent to the API is not used to train OpenAI's models under OpenAI's API terms.
- The product does not require patient identifiers, and the Terms of Service prohibit entering them. A report is drafted from the findings, the indication and the study type, none of which needs a name, record number or date of birth.
- There is no advertising and no third-party analytics on the application, and the feedback system is built so report text cannot leave with it.
Why "does not need PHI" is the important design choice
Most of the HIPAA surface of a reporting tool comes from identifiers travelling with the clinical text. GigHz Precision AI was designed so that the clinical content is useful without them: the template is chosen from the study name, the findings are placed from their anatomy, and the impression is composed from the findings and the indication. Nothing in the workflow asks for who the patient is. The application instructs users not to enter identifiers, the Terms make that a condition of use, and the privacy notice explains it. A user who follows the Terms is sending de-identified clinical text.
That is also why the vendor agreements are described carefully: a Business Associate Agreement between GigHz LLC and its vendors governs GigHz LLC's obligations to those vendors; it does not by itself authorise an individual user to submit PHI. For a covered entity that wants to use the product with identifiable data, the right instrument is a Business Associate Agreement between that entity and GigHz LLC. Contact signal@gighz.com to discuss one.
The data flow, step by step
| Step | What moves | Where | Protection |
|---|---|---|---|
| Dictation | Audio from your microphone | Your browser to the transcription service | TLS; audio is streamed, not stored by GigHz Precision AI |
| Placement | Each sentence and the current report state | Application server to the language model API | TLS; API terms exclude training; no identifiers needed |
| Impression | The placed findings and indication | Same | Same |
| Report history | The finished report text | Application server, encrypted storage, per-account | Encrypted at rest; retrievable only by that account |
| Feedback | Metadata (study, feature flags, counts, your comment) | Application server | Report text and indication are structurally excluded |
| Account emails (verification, password, onboarding) | Amazon SES from the application's own domain | DKIM and SPF; no report content in any email |
Infrastructure and agreements
- Hosting: Amazon Web Services, United States region, HIPAA-eligible services only, under the AWS Business Associate Addendum. Compute, storage and email are all inside that account.
- Language and transcription models: OpenAI API services under agreements covering that processing. Content is not used to train models under the API terms.
- Edge: the application domain is served directly from AWS over TLS; it is deliberately not proxied through a content delivery network, so no third party terminates TLS for clinical traffic. See Security architecture.
- No other processors receive clinical content. Payment processing (Stripe) receives billing details only; the Google Sheet that records signups receives account metadata only.
What a covered entity should check
- Identifier policy. Confirm your radiologists understand the product does not need identifiers and that your workflow does not paste them in.
- Agreements. If you intend to use identifiable data, request a BAA with GigHz LLC.
- Access control. Each radiologist has an individual account; there are no shared logins, and administrative functions are separated from clinical use. See Security architecture.
- Retention. Review Data handling and retention against your own retention schedule; account deletion is available on request.
- Audit. Access to the application is logged by account; email delivery is logged; feedback is logged without content.
What we do not claim
We do not describe the product as "HIPAA certified" because no such certification exists, and we do not describe it as "HIPAA compliant" as a blanket statement, because compliance is a property of how a covered entity and its business associates operate together, not a label a vendor can apply to itself. What we can state is the architecture, the agreements and the design choices above, and we keep this page current as they change.
Related
- Security architecture
- Data handling and retention
- AI models and limitations
- Terms of Service (version PRECISION-TOS-2026-08-31-v0.9) and Privacy Notice (version PRECISION-PRIV-2026-08-31-v0.9), shown and accepted at signup
This page is generated from documentation that ships with the application (docs v1.2.2). Version numbers, prices and trial lengths on this page are read from the running system, not typed by hand.