HIPAA Compliance

HIPAA is a shared responsibility

HIPAA compliance depends on the specific service, implementation, data flow, users, policies, and contractual relationship involved. Use of a Brightcore AI website or product does not by itself establish a Business Associate relationship or constitute a representation that every workflow is HIPAA compliant.

PHI handling

Do not submit, upload, email, or enter PHI through public website forms, general support channels, downloadable-resource forms, or consumer AI tools unless Brightcore AI has expressly authorized that workflow in writing and all required safeguards and agreements are in place.

Authorized workflows

When a Brightcore AI offering is approved to create, receive, maintain, or transmit PHI, the applicable service agreement, implementation documentation, and Business Associate Agreement (when required) control the permitted use of that information.

Customer responsibilities

• Confirm you have authority to provide any information to the service.
• Use the minimum necessary information for the intended purpose.
• Follow your organization’s privacy, security, retention, and incident-response policies.
• Configure and use the product only within its approved implementation scope.
• Maintain appropriate user access controls and training within your organization.

De-identified and educational content

Brightcore AI resources, demonstrations, and educational material should use de-identified, synthetic, or otherwise authorized information. Removing obvious identifiers alone may not be sufficient to de-identify health information under applicable law.

Questions

For product-specific security, privacy, implementation, or agreement questions, contact us through our contact page.

HIPAA’s Privacy and Security Rules establish standards for protecting health information; see the HHS Privacy Rule overview and HHS Security Rule overview for official guidance.