Pretium Health Solutions
HIPAA-ready posture

Trust & Security

This page is maintained by Pretium Scriber to answer common security and privacy questions about how we protect protected health information (PHI) in our AI clinical scribe. It describes controls that are enabled today. It is not a third-party certification or audit report.

Encryption

  • PHI is encrypted in transit using TLS between your browser, our application, and backend services.
  • Data at rest, including database rows, recordings, and transcripts, is encrypted at rest by our managed cloud infrastructure.
  • Audio recordings are stored in a private storage bucket and served via short-lived signed URLs; direct public access is not permitted.

Access controls & authentication

  • Sign-in uses email/password or Google OAuth. Passwords are never stored in plaintext.
  • Every table containing PHI enforces row-level security. Clinicians only see patients, sessions, notes, and appointments in workspaces they belong to.
  • Role-based access separates workspace owners, admins, and clinicians. Platform-admin actions are gated by a separate server-side role check.
  • Patient records are scoped to a primary clinician plus explicit, time-bounded handoffs; access is not open across the whole workspace by default.

Audit logging

  • Sensitive actions (note creation, exports, handoffs, admin changes) write to an append-only audit log with actor, workspace, timestamp, and target record.
  • Audit records are readable only by workspace admins for their own workspace.

Data retention & deletion

  • Each workspace configures its own retention window for notes, sessions, and patient records. Records past their expiration are eligible for automated deletion.
  • Transcript cache entries have their own expiration and are automatically purged after the configured window.
  • Workspace admins can extend retention on individual records, and can request full deletion of a workspace's PHI on offboarding.

HIPAA & Business Associate Agreements

  • Pretium Scriber is designed for use with PHI under HIPAA. Before you process real PHI, a signed Business Associate Agreement (BAA) must be in place between your organization and Pretium Scriber.
  • Our workspace settings include a BAA acknowledgement so admins can record when a signed BAA is on file for their workspace.
  • To request or execute a BAA, contact us at the address below.
  • This page is not a legal certification. HIPAA compliance is a shared responsibility — your organization is responsible for workforce training, minimum-necessary policies, device security, and how PHI is entered into the product.

Shared responsibility

  • Pretium Scriber provides the technical safeguards described above (encryption, RLS, audit logging, retention controls, signed URLs).
  • Your organization is responsible for: user provisioning and deprovisioning, choosing what PHI to enter, workforce HIPAA training, endpoint security, and workspace-level configuration (retention windows, roles, handoffs).

Security & privacy contact

To request a BAA, report a suspected security issue, or ask a privacy question, email sales@pretiumhealthsolutions.com or call +1 (470) 779-2933. We aim to acknowledge security reports within one business day.

Last reviewed: September 2026. Controls listed reflect current product configuration and may evolve as the product changes.