VCare Health is a HIPAA-aligned AI platform for patient communication. We sign a Business Associate Agreement with your practice, implement the technical, administrative and physical safeguards required by the HIPAA Security Rule, and maintain an internal HIPAA compliance program documented in our HIPAA Handbook. HIPAA is a shared responsibility — here is exactly what we handle and what stays with you.
| Fact | What we state |
|---|---|
| Business Associate Agreement | Signed with your practice before go-live. Scope is customizable. |
| Hosting | AWS, United States (us-east-1), HIPAA-eligible environment. |
| Encryption | TLS 1.2 or higher in transit. Argon2id for passwords. AWS KMS for audit logs. |
| Access | Role-based, six roles. SMS MFA on by default for new accounts. |
| Audit logs | Who, what, when, and where on every PHI access. |
| Breach notification | Clinic notified within 72 hours of confirmed impact. |
| Compliance contact | Liliia Lytvyn, Security and Privacy Officer · compliance@vcare-health.com |
A Business Associate Agreement is the contract between a covered entity, your practice, and a business associate, VCare, when the associate creates, receives, maintains, or transmits protected health information. It sets the permitted uses of that information, the safeguards the associate must keep, and how a breach is reported. VCare signs that agreement with your practice before go-live, before patient information flows.
The agreement covers the current product scope: voice, reminders, and scheduling. The scope can be customized, and your practice may use its own BAA. We run on HIPAA-eligible infrastructure and are completing Business Associate Agreements with our subprocessors. The clinic agreement is not a statement that those subprocessor agreements are already signed.
Technical safeguards (§164.312) are access control across six roles with SMS MFA on new accounts, audit controls in CloudWatch, and transmission security with TLS 1.2 or higher. Administrative safeguards (§164.308) are a designated Security and Privacy Officer, Liliia Lytvyn, a risk analysis once a year and when the product or a vendor changes in a way that affects patient data, workforce training before access and then each year, and a sanction policy in the HIPAA Handbook. Physical safeguards (§164.310) are the Amazon Web Services data centers that host VCare in the United States. Detail is on the security page.
On an inbound call the assistant confirms the phone number, then looks the patient up by it. If several records share a number it asks for the full name, and only then the date of birth if still ambiguous. Booking, cancelling, or rescheduling requires the date of birth to be verified and the caller to confirm the visit. The stored date of birth is never read back; a failed check is answered with "that doesn't match our records."
The assistant only schedules and manages appointments. It gives no medical advice, diagnosis, billing, or insurance help. Prescription and medication requests, and any request for a person, are transferred to staff.
Reminders are sent by template through Twilio, never composed by the AI. A message contains the patient's name, the clinician or care team, the date and time, and a short action (reply CONFIRM, a manage link, "arrive 15 minutes early"). SMS never includes date of birth, diagnosis, insurance, or clinical notes.
| VCare handles | Your practice handles |
|---|---|
| BAA with your practice; Security Rule safeguards; encryption in transit; access control and MFA on new accounts; audit logging; breach notification within 72 hours; internal HIPAA program and Handbook. | Your own policies and workforce training; configuring staff roles; deciding what information goes into reminders; choosing which patients get SMS; your BAAs with other vendors. |
Our HIPAA program is assessed internally by our Security and Privacy Officer and documented in our HIPAA Handbook, which covers PHI identifiers, technical and organizational safeguards, access control, and data handling. We run a risk analysis once a year and whenever the product or a vendor changes in a way that affects patient data. We have not yet completed an independent assessment, SOC 2 audit, or penetration test; we will say so plainly rather than imply a certification we don't hold.
Yes. VCare signs a Business Associate Agreement with your practice before go-live. It covers voice, reminders, and scheduling, and the scope can be customized. You may use your own BAA. We are completing Business Associate Agreements with our subprocessors and do not describe those agreements as already signed.
VCare is HIPAA-aligned. We sign a BAA with your practice and keep an internal program in the HIPAA Handbook, with a designated Security and Privacy Officer, an annual risk analysis, and workforce training. There is no HIPAA product certification. Compliance stays a shared responsibility between VCare and your practice.
VCare reminders are HIPAA-aligned. They are sent by template through Twilio and are not composed by the AI. We sign a BAA with your practice before patient information flows, and the message stays minimum necessary. We are completing a Business Associate Agreement with Twilio. That subprocessor agreement is not signed yet.
A reminder contains the patient name, the clinician or care team, the date and time, and a short action such as reply CONFIRM, a manage link, or arrive 15 minutes early. Reminders are sent by template through Twilio, never written by the assistant. SMS never includes date of birth, diagnosis, insurance, or clinical notes.
This page does not claim that protected health information is kept out of model training. Calls are handled by ElevenLabs Conversational AI. Conversation text is processed by Anthropic's Claude Haiku 4.5 through ElevenLabs. A no-train statement waits on those vendors' terms and on Business Associate Agreements that are still being completed.
Patient data is hosted on Amazon Web Services in the United States (us-east-1), in a HIPAA-eligible environment. That hosting covers the application, database, storage, and audit logs. Further control detail is on the security page. We are completing Business Associate Agreements with the subprocessors that also handle patient data.
Yes. Your practice can bring its own Business Associate Agreement. VCare reviews it and signs before go-live, before patient information flows. The starting scope is voice, reminders, and scheduling, and that scope can be customized. The agreement is between your clinic and VCare. We do not treat a clinic BAA as coverage of every subprocessor.
No. HIPAA does not certify software products. VCare is HIPAA-aligned: a Business Associate Agreement with your practice, Security Rule safeguards, and an internal program documented in the HIPAA Handbook. That program is assessed internally. We have not completed an independent assessment, a SOC 2 audit, or a penetration test.
If patient data is affected, we notify the clinic account contact without undue delay and no later than 72 hours after we confirm the impact. The notice states what happened, which data was involved, when we found it, what we did, and what you should do. If the investigation is still open, we send an initial notice and follow up.
Liliia Lytvyn is the designated Security and Privacy Officer for VCare Health. She leads the internal HIPAA program documented in the HIPAA Handbook, including the annual risk analysis and workforce training. For a BAA or a compliance question, write to compliance@vcare-health.com. Her role is also listed on the About page.
Write to compliance@vcare-health.com or use the form. You can also download the overview.
