Security & Compliance
One page for your security and compliance team: how protected health information moves through MyRadAgent, who processes it under which agreement, how access is controlled, and what we do not yet claim. Last updated 2026-11-03.
De-identificationPHI is redacted before any AI model call, on every input, every time.
AgreementsBAAs executed with OpenAI, Anthropic, Google, Meta and Railway. A BAA with your practice on any paid plan.
Your dataNever used to train any vendor's model. Isolated per account. Exportable and deletable on request.
PostureHIPAA-aligned: TLS 1.2+ in transit, encrypted at rest, role-based access, audit log retained 7 years.
1. How a report moves through the system
1 · InputScratch dictation, worksheet text or image from your browser or the desktop client, over TLS.
2 · RedactionAutomated HIPAA Safe Harbor pass on our server replaces all 18 identifier types with non-reversible tokens.
3 · DraftingOnly the redacted text goes to the AI vendor(s) selected for that study, under an executed BAA.
4 · ReviewThe draft returns to you. Any original identifiers are re-inserted on your side; only redacted text is stored.
5 · SigningYou edit and sign in your own reporting system. MyRadAgent never signs, sends or files a report.
The redaction step is not optional and is not disabled by the BAAs. It runs as defence in depth on every call, including calls to vendors we have agreements with.
2. De-identification
- Text. Names, dates, medical record and accession numbers, phone numbers, addresses, device identifiers and the remaining Safe Harbor identifiers (18 categories) are detected and replaced before transmission. The redactor is negation- and context-aware so clinical content such as measurements and laterality is preserved.
- Images. Radiographs and screenshots may carry burned-in identifiers (overlays, annotations) that text redaction cannot remove. The desktop client's DICOM import strips DICOM metadata; the video upload path requires a crop before anything leaves the workstation; for screenshots, you are responsible for clearing burned-in PHI before upload.
- Case bank and teaching material. Write-ups kept for conferences are de-identified twice: the PHI redactor, then a second pass that removes dates, ages over 89 and record numbers.
3. Subprocessors and agreements
Redacted content is transmitted only to the processors below, only as needed to produce the draft you asked for.
| Processor | Purpose | Agreement |
|---|---|---|
| OpenAI | Report generation, image analysis, worksheet OCR, embeddings | BAA executed 2026-11-02 |
| Anthropic | Second-opinion review in consensus mode, fallback | BAA executed 2026-11-02 |
| Vision screening, consensus, volume analysis | BAA executed 2026-11-02 | |
| Meta Platforms | Report generation and image analysis when the Muse model is selected; prompts and outputs are not used to train Meta models | BAA executed |
| Railway Corp | Application hosting, managed PostgreSQL, logs | BAA executed 2026-11-02 |
| Stripe, Inc. | Payment processing (billing data only; no PHI) | PCI DSS processor; not a PHI subprocessor |
A Business Associate Agreement between MyRadAgent and your practice or health system is signed on any paid plan and is included with Enterprise. Email support@myradagent.ai with "BAA request" in the subject.
4. Your data stays yours
- No model training. Neither we nor our vendors train foundation models on your inputs, drafts or signed reports. Your corrections improve only your own style rules and retrieval memory.
- Isolation. Style rules, corrections, retrieval memory, the case bank and analytics are keyed to your account. No other user, group or administrator view lists them. Group (practice-admin) workspaces are isolated from every other customer.
- Export. Everything you have stored is downloadable at any time from Settings → Export Data, as JSON and plain text.
- Deletion. On request we delete all personal data and confirmed reports within 30 days. Audit logs are kept for the statutory period.
5. Retention
| Data | Retained |
|---|---|
| Unconfirmed drafts (generated, never saved) | Discarded after 48 hours |
| Confirmed (signed) reports, de-identified | Life of the account plus 90 days after cancellation |
| Images attached to corrections | While the account is active |
| Usage and audit logs | 7 years |
6. Access and authentication
- Sign-in. Email and password (bcrypt-hashed, per-user salt), or Google and Microsoft sign-in over OpenID Connect. Sessions are signed tokens; the token never appears in a URL.
- Brute-force controls. Login attempts are rate-limited per IP address and an account locks for 15 minutes after five failed attempts. Signups are rate-limited per IP.
- Roles. Radiologist, practice administrator and site administrator roles; administrative routes are server-enforced, not hidden in the interface.
- Desktop client. Bound to a paid account and signed in with the same credentials; every AI call it makes goes through myradagent.ai, so the same redaction and the same agreements apply at the workstation.
- Single sign-on. Google and Microsoft OIDC today. SAML federation with your identity provider is on the Enterprise roadmap; tell us which IdP you use.
7. Encryption and hosting
- TLS 1.2 or higher between your browser or desktop client and our servers, and between our servers and every subprocessor.
- Data at rest is encrypted at the storage layer by our hosting provider (Railway, managed PostgreSQL).
- No third-party analytics or advertising trackers anywhere on the site or in the app. First-party cookies and local storage are used only for authentication and interface state.
8. Logging and monitoring
- An audit log records logins, administrative actions, data exports, deletions, case-bank deck downloads and other high-impact events, with the acting user and timestamp.
- Usage logs record each AI call's endpoint, models and cost for quota and quality monitoring; they do not contain report text.
- Enterprise customers can request an audit-log export for their own users.
9. What we do not yet claim
We would rather you hear this from us than find it in diligence.
- We have not yet completed a third-party security attestation or an independent penetration test. Both are planned as the first group customers come on board.
- SAML single sign-on and an on-premises deployment option are not available today.
- "HIPAA-aligned" is the precise claim. HIPAA has no certification; what exists is the executed BAAs above, the redaction pipeline, the controls on this page and the clinical disclaimer.
10. Incidents and disclosure
- Suspected security issues: support@myradagent.ai with "Security report" in the subject. Every report is read and acknowledged by the founder.
- In the event of a breach affecting PHI, we notify affected customers as required by our BAA and applicable breach-notification law.
11. Clinical boundary
MyRadAgent is clinical decision support. Every output is a draft for review by a licensed radiologist, who remains responsible for the final report. It does not render a diagnosis and does not transmit reports to any system on its own. See the clinical disclaimer.
For your security team
We complete vendor security questionnaires and walk through this page on a call. If you are evaluating several vendors, our twelve-question security checklist for AI radiology reporting tools is vendor-neutral and worth sending to all of them. The privacy policy and terms of service contain the contractual versions of the statements above; the validation page shows how the accuracy figures on this site are measured.