Hosting, HIPAA Compliance & PHI Handling.

ClearChart.AI is built from the ground up for healthcare-grade privacy, security, and operational integrity. The platform operates in a HIPAA-compliant cloud environment, with strict safeguards for how data is accessed, used, and retained. No Protected Health Information (PHI) is stored or used for training. Data is accessed temporarily—only when needed—and under tightly controlled conditions aligned with Epic's SMART on FHIR standards.

• HIPAA-Compliant Hosting
  ClearChart.AI is hosted in a secure, cloud-based infrastructure that complies fully with HIPAA, using encryption for data in transit and at rest, and hardened to enterprise-grade security standards. See more on HIPAA on our Privacy page
   
• OAuth2-Based Access Control
  All patient access is governed by OAuth2 authentication and SMART on FHIR scopes. Only the minimum data needed is accessed, and only with explicit session authorization.
   
• No PHI Retention or Training Use
  ClearChart.AI never stores PHI after session access. The AI model is not trained on patient data—ensuring privacy, reducing regulatory risk, and supporting safe scalability.
   
• Ephemeral Access Sessions
  All data interactions are session-bound. Once a patient views their summary, the session closes, and access is revoked. No caching, reuse, or background data retention occurs.

• Read-Only, Respectful Access
  The platform only reads what’s already visible in Epic/MyChart. No information is written back to Epic, modified, or shared with third parties.
   
• Designed to Minimize Risk
  The architecture intentionally limits data scope, avoids long-term storage, and isolates operational components—creating a controlled, auditable environment that protects patient privacy. Security page.
   
• Built for Security Review
  ClearChart.AI’s security protocols and session handling align with Epic’s review expectations and industry best practices—positioning the platform for approval in complex enterprise environments.

ClearChart.AI delivers patient-facing communication without compromising privacy or security. It uses short-term, read-only access via SMART on FHIR; never stores or trains on PHI; and complies with HIPAA and enterprise security frameworks. The platform is ready for deployment in even the most risk-sensitive healthcare settings.