When integrating artificial intelligence into your practice, data privacy and security are the highest priorities. BastionGPT is designed from the ground up as a fully HIPAA compliant AI platform, ensuring that medical professionals can leverage the best medical AI without compromising patient trust or violating federal regulations. That commitment is formalized in the BAA included with every plan. A full security and data-protection overview is also available on our website.
Built by Healthcare and Cybersecurity Experts
Our solution is built and continuously maintained by a dedicated team of experienced cybersecurity and healthcare professionals. With decades of combined experience in managing HIPAA secure systems and a deep understanding of complex healthcare regulations, our team ensures that BastionGPT remains the most trusted healthcare AI assistant. We regularly scan our service for vulnerabilities and conduct rigorous, ongoing assessments to maintain strict HIPAA compliance.
Enterprise-Grade Infrastructure and Partnerships
Whether you are using our tools as an AI medical scribe, an AI for therapy notes, or for general AI clinical documentation, your data is protected by enterprise-grade security. BastionGPT is a strategic partner with Microsoft. This ensures that our HIPAA compliant LLM (Large Language Model) is backed by world-class, heavily encrypted cloud architecture. Additional information about our AI partnership with Microsoft can be found on their website or via the official Press Release.
Securing Your Clinical Workflow
Unlike standard consumer-grade AI tools, BastionGPT is specifically built as a ChatGPT for healthcare. We secure every step of your clinical workflow, ensuring that your data never trains public models:
Medical Documentation AI: Safely generate progress notes, discharge summaries, and comprehensive clinical documentation without risking patient PHI.
AI Scribing and Dictation: Utilize our HIPAA compliant AI transcription and medical dictation AI to capture patient encounters accurately and securely.
Therapy Documentation: Private clinicians and mental health professionals can confidently use the best AI for therapy notes, knowing their highly sensitive therapy documentation software meets all rigorous privacy standards.
What happens to my data when I use BastionGPT?
Your data follows a short, tightly controlled path. When you send a message or upload a document, the data moves from your account into a hardened secure enclave, a processing environment separated from the rest of our infrastructure, where the AI reads it and generates your response. That processing takes anywhere from milliseconds up to about 30 seconds. The data is then securely wiped from the enclave, and your results are returned to your account.
Along the way, we hold to a few firm commitments:
Your data is never used to train AI models. This is true no matter how long the data is retained.
Your data is never resold and never used for marketing. You retain all rights to your data; we hold it temporarily for the sole purpose of providing your AI services.
Retention is limited. Data is kept for a maximum of 30 days, and in most cases it is purged much sooner. Our article on how long we keep data and deletion covers the full retention picture.
For details on what reaches the model providers, see Is my chat data shared with OpenAI?
Why is data kept up to 30 days instead of zero?
Healthcare work sometimes involves difficult subject matter, such as writing a clinical report on an abuse case, so we relax certain AI safety filters that would otherwise block that legitimate work. Because those filters are relaxed, our licensing agreements with AI model providers require us to keep limited, short-term logs so misuse of the system can be detected. Thirty days is the ceiling, not the norm.
Do you de-identify my data before processing?
No, and that is deliberate. De-identification technology is roughly 99.9% accurate, and at the scale we operate, the remaining fraction would still mean exposed patient records at scale. Since the technology is not 100%, we take the safer path: we treat everything you enter as protected health information and protect it with controls designed to meet or exceed the standards that EMR and EHR systems are held to. For more on how your data stays out of model training, see Does BastionGPT train AI on my data?
What happens if my records are subpoenaed?
It is rare, but it does happen, and we coordinate with you throughout. In most cases the requested data is already past our retention period. When that is true, we provide a letter on company letterhead certifying that the data was securely wiped on a specific date, which you can present as evidence that nothing responsive exists.
Transparency and Compliance Resources
We believe in complete transparency for providers using AI in medicine and healthcare. Detailed security information is readily available on our Security page. Furthermore, we are happy to provide additional cybersecurity technology documentation and detailed architecture diagrams upon request to satisfy your organization's internal compliance requirements.
For a practical look at these protections in action, see Is it safe to upload patient records?
Are you ready to explore how a HIPAA compliant ChatGPT alternative can safely transform your medical practice? Feel free to schedule a call or message our team to speak directly with a healthcare compliance expert today.