HIPAA Compliance & Security

ParrotPadMD is designed from the ground up for healthcare. Your patients' privacy is our priority.

How We Protect PHI

No Audio Storage

  • Audio is processed in-memory only
  • Immediately discarded after transcription
  • Never written to disk or stored in databases
  • No audio recordings are retained

No Storage of Dictation into Your EHR

  • Text you dictate at the cursor goes directly into your EHR
  • We never store it
  • Your EHR is the system of record
  • Notes you write or dictate in the Scratchpad are different. They are saved encrypted in your account as you go, so they follow you to another device, until you delete them
  • Encounter recordings are different too. The recording is deleted after transcription, and the transcript and notes are stored encrypted in your account until you delete them (see "Encounter Audio Handling" below)
  • You can choose, under Security on your account page, to have stored visits and notes deleted automatically after 30 or 90 days, and you can delete your whole account there

No Training on PHI

  • Your dictations are never used to train AI models
  • Our speech models are pre-trained
  • Your data doesn't improve or train the system
  • Complete data isolation per user

When Text Goes to Your Clipboard

The extension types your dictation, or inserts a finished note, at the cursor. Some editors do not accept typed text, so the extension places the text on your computer's clipboard and pastes it for you. When it cannot confirm that the text arrived, it leaves the text on the clipboard and a notice tells you to paste it. Otherwise text reaches the clipboard only when you press Copy.

Text placed on the clipboard stays there afterward. The clipboard belongs to your device, not to ParrotPadMD, and we cannot clear it. If your Mac shares its clipboard with your other Apple devices (Universal Clipboard), the text can reach them too. Copy something else afterward if you share the computer. The extension never collects or sends anything from your clipboard.

Business Associate Agreement (BAA)

Our BAA Coverage

ParrotPadMD has a signed Business Associate Agreement with every vendor that can touch PHI, covering:

  • AssemblyAI, Inc. — real-time speech-to-text
  • Google Cloud Speech-to-Text API
  • Google Cloud Healthcare API
  • All data processing infrastructure

Your BAA with Us

When you sign up for Pro or use ParrotPadMD for PHI:

  1. Review the BAA at parrotpadmd.com/baa.html
  2. Accept the BAA during account setup
  3. Your acceptance is timestamped and recorded
  4. Request a countersigned copy at compliance@parrotpadmd.com

Encounter Audio Handling

When you record a patient encounter, audio is handled with the same strict privacy standards:

  • Audio is encrypted in transit (TLS 1.3) during upload to our transcription provider
  • Audio is encrypted at rest (AES-256) while being processed
  • Audio is automatically deleted after transcription completes — never stored long-term
  • Transcription uses a medical speech model under our BAA
  • Speaker diarization happens server-side during transcription — no separate audio copy is made

AI Processing & Privacy

ParrotPadMD uses Google Gemini AI for text cleanup and clinical note generation. Here's how we protect your data:

  • No PHI stored by AI — Transcripts are processed in-memory and never saved by the AI service
  • No model training — Your data is never used to train or improve AI models
  • Vendor BAA — note generation and text cleanup run on Google Gemini, covered under our Business Associate Agreement with Google Cloud
  • Stateless processing — Each AI request is independent; no patient context is retained between requests
  • US processing only — All AI processing occurs on US-based infrastructure

Technical Security Measures

Encryption

  • TLS 1.3 encryption for all data in transit
  • Audio transmitted over encrypted HTTPS connections
  • No plaintext audio transmission

Infrastructure

  • SOC 2 Type II certified Google Cloud infrastructure
  • Enterprise-grade data centers
  • Automatic failover and redundancy
  • Regular security audits

Access Controls

  • Your account is authenticated via OAuth 2.0
  • Session tokens expire and auto-refresh
  • No shared accounts or credentials
  • Audit logging of all API calls

Data Flow

Here's exactly what happens when you dictate:

1. You speak into microphone
   ↓
2. Audio captured by Chrome (in browser memory)
   ↓
3. Audio sent via TLS 1.3 to our speech-to-text provider
   (AssemblyAI or Google Cloud Speech-to-Text — each under a BAA)
   ↓
4. Provider processes audio → returns text (audio discarded)
   ↓
5. Text sent back to browser via TLS 1.3
   ↓
6. [Optional] AI Text Cleanup via Gemini (stateless, no storage)
   ↓
7. Text inserted at your cursor
   ↓
8. Text saved to your EHR (your system of record)

Encounter Recording Flow:
1. Audio recorded in browser
   ↓
2. Uploaded via TLS 1.3 to Google Cloud Storage (encrypted)
   ↓
3. Transcribed with speaker diarization (medical speech model)
   ↓
4. Audio deleted from cloud storage
   ↓
5. Transcript stored in your account (Firestore, encrypted)
   ↓
6. [Optional] AI generates clinical note (Gemini, stateless)
   ↓
7. Note copied to your EHR

We never:

  • Store audio files
  • Store transcription text
  • Log PHI content
  • Train models on your data
  • Share data with third parties

Your Responsibilities

As a covered entity using ParrotPadMD:

  1. Accept the BAA before using with PHI
  2. Secure your device — use password/biometrics
  3. Log out when leaving shared computers
  4. Report incidents to support@parrotpadmd.com

Compliance Certifications

Our Certifications & Agreements

  • ✅ BAA with every PHI subprocessor
  • ✅ Google Cloud SOC 2 Type II infrastructure
  • ✅ TLS 1.3 encryption in transit
  • ✅ No PHI storage policy
  • ✅ Audit logging enabled

What We Don't Do

  • ❌ Store audio recordings
  • ❌ Store transcription text
  • ❌ Train on PHI
  • ❌ Share data with advertisers
  • ❌ Process data outside the US (standard config)

Frequently Asked Questions

Is ParrotPadMD HIPAA compliant?

Yes. We have a BAA with every vendor that can touch PHI, encryption in transit and at rest, access logging, and optional two-step sign-in. What we store (Scratchpad notes, visit transcripts and generated notes) lives only in your account, encrypted. Every account accepts our BAA before it dictates or records.

Do you store my dictations?

Not what you dictate into your EHR. That text goes directly to your cursor and is never stored. Notes you write or dictate in the Scratchpad are saved to your account, encrypted, until you delete them, and you can choose to have them deleted automatically after 30 or 90 days.

Can I get a BAA?

Yes. Every account accepts our BAA before it dictates or records, and you can read it at parrotpadmd.com/baa.html. Enterprise customers receive a countersigned copy.

Where is data processed?

Audio is processed by our speech-to-text providers — AssemblyAI and Google Cloud Speech-to-Text — on servers in the United States. No data is processed outside the US by default.

What happens if there's a breach?

We have incident response procedures. We would notify affected users within 72 hours as required by HIPAA. Contact compliance@parrotpadmd.com to report concerns.

Contact