Patient Consent Guidance
We recommend a two-step approach that covers both intake and the moment of care.Written waiver at intake
Have patients sign a written waiver as part of their intake paperwork, before the visit begins.
Platform FAQ
What does the platform capture?
What does the platform capture?
When recording is activated, the platform captures ambient audio from the patient encounter along with patient demographic data. That audio is converted into transcripts and structured clinical outputs.
Is raw audio retained, or only the generated note? What is the default retention period?
Is raw audio retained, or only the generated note? What is the default retention period?
Both are retained. Patient demographic data, audio recordings, transcripts, generated clinical outputs, and usage logs are all retained for 6 years.
Where is data stored? Is it kept in the United States?
Where is data stored? Is it kept in the United States?
For US-based customers, all data is processed and stored within the United States.
What encryption standards are used in transit and at rest?
What encryption standards are used in transit and at rest?
Data in transit is encrypted with TLS 1.2 or higher. Data at rest is encrypted with AES-256.
How are access controls managed, and is there an audit trail?
How are access controls managed, and is there an audit trail?
Access is role-based on a least-privilege model and provisioned only through documented requests. Comprehensive audit logs capture access, edits, and exports at the individual record level. Access permissions are reviewed monthly.
What certifications or attestations does Commure hold?
What certifications or attestations does Commure hold?
Commure holds a SOC 2 Type II attestation. Full security documentation is available at the Commure Trust Center.
Are there subprocessors or third parties that handle patient data?
Are there subprocessors or third parties that handle patient data?
Yes. Subprocessors are involved. All are HIPAA-compliant, have Business Associate Agreements (BAAs) in place, and undergo security reviews at least annually.
Is patient data used to train AI models? Can that be turned off?
Is patient data used to train AI models? Can that be turned off?
No. Models are never trained using Protected Health Information (PHI). There is no opt-out required.
What is the breach notification process and timeline?
What is the breach notification process and timeline?
The breach notification process and timeline are defined in the active Business Associate Agreement (BAA). Please refer to that document for specifics.
See also HIPAA Compliance & BAA and Data Retention Policy.