HIPAA Compliance & Business Associate Agreements

Our Commitment to HIPAA

Mental Note AI is built from the ground up with HIPAA compliance in mind. We know you work with sensitive patient information every day, and we've engineered our platform to protect that data at every step.

We encrypt PHI in transit and at rest and process it under Business Associate Agreements with our infrastructure providers. We minimize how long we retain data, never sell it, and never train AI models on your notes. You can request deletion at any time.

What is HIPAA?

HIPAA (Health Insurance Portability and Accountability Act) is a federal law that protects the privacy and security of patient health information. For mental health professionals, HIPAA requires that you:

• Protect patient privacy: Keep patient health information (PHI) confidential and only use it for treatment, payment, or healthcare operations
• Maintain security: Use appropriate safeguards to prevent unauthorized access, use, or disclosure of patient data
• Notify patients: If there's ever a breach of their health information

If you're a healthcare provider or work for a covered entity, HIPAA compliance is not optional—it's a legal requirement.

How Mental Note AI Addresses HIPAA Requirements

Privacy Rule

We encrypt patient information and process it under Business Associate Agreements, minimizing how long we retain it.

Clinical content is processed by our AI service providers under BAAs and encrypted in transit and at rest. We restrict internal access and let you request deletion.

Security Rule

Our security practices include:

• Encryption: All communication between Mental Note AI and Microsoft's infrastructure uses industry-standard encryption
• Access controls: Only authorized personnel have access to system infrastructure
• Microsoft infrastructure: Mental Note AI leverages Microsoft's HIPAA-compliant cloud infrastructure. For more details, see our Security page

Breach Notification Rule

We maintain incident response procedures and protocols for investigation, impact assessment, and notification as required by HIPAA. We minimize the data we retain and encrypt it in transit and at rest to reduce breach risk.

Data Protection: Why It Matters

Our data-protection approach:

Here's how it works:

1. You describe your clinical session in your Word document
2. Mental Note AI processes that description in real-time
3. The generated note is returned directly to your Word document
4. Data is encrypted and retained only as needed; you can request deletion

Your data is encrypted, access-restricted, and handled under a BAA, and you retain control of your documents.

Business Associate Agreement (BAA)

A Business Associate Agreement is a contract between a covered entity (like your practice) and a business associate (like Mental Note AI). It establishes legal obligations for protecting patient health information.

If you're a HIPAA covered entity or work with one, you need a BAA with Mental Note AI — and you have one: it is included on every plan and accepted in the app before your first session. The BAA clarifies:

• How Mental Note AI handles patient health information
• Mental Note AI's obligations to protect that information
• How to handle security incidents or breaches
• Your rights to audit and monitor Mental Note AI's practices

No request needed. The Business Associate Agreement is presented in the app the first time you record or write a session; your acceptance (document version, date and time) is recorded and shown on your Account page. Need a countersigned copy or a custom agreement for your organization? Email support@mentalnote.ai.

Your Responsibilities

Mental Note AI supports HIPAA compliance, but you remain responsible for compliance at your practice. This includes:

• Review AI drafts: Always review notes before putting them in a patient's medical record. AI augments your judgment; it doesn't replace it
• Your own safeguards: Implement policies, training, and access controls at your practice
• Secure Microsoft: Use strong passwords, multi-factor authentication, and access controls on Word and Office 365
• Train staff: Ensure anyone using Mental Note AI understands HIPAA and your practice's information policies
• Document use: Keep audit records of how Mental Note AI is used in your practice

Microsoft's Role

Mental Note AI operates within Microsoft's ecosystem as a Word add-in. Microsoft maintains its own HIPAA compliance program and offers Business Associate Agreements for Office 365 users.

Microsoft's infrastructure supports HIPAA compliance under BAA and is used by major healthcare organizations. If you have concerns about Microsoft's compliance or need a BAA with them directly, you can review their compliance documentation and request a BAA for your Office 365 subscription.

Frequently Asked Questions

HIPAA Questions?

If you have questions about HIPAA compliance, need a countersigned copy of our Business Associate Agreement, or have concerns about how Mental Note AI handles patient data, please contact our team:

Email: support@mentalnote.ai

We're here to help you use Mental Note AI with confidence.