AskVault and HIPAA, not supported
Where AskVault stands on HIPAA
AskVault does not currently sign Business Associate Agreements (BAAs) on any plan, and AskVault is not HIPAA compliant. Do not upload, collect, or send protected health information (PHI) through AskVault. That covers documents, chats, calls, emails and messages on every channel.
Some of the infrastructure providers we use offer HIPAA-eligible services, but that does not make AskVault HIPAA compliant, and no BAA covers your data. Our database provider holds a SOC 2 Type II report; AskVault does not have its own SOC 2 report. The provider list is available on request from [email protected].
If you read an earlier version of this page: it described an Enterprise BAA, a dedicated PHI workspace and audit retention of 6 years. None of those are offered, and this page replaces it.
Using AskVault in healthcare without PHI
A clinic, practice or health-tech company can still use AskVault for information that identifies no patient:
- Fine to index. Clinic hours, locations, accepted-insurance lists, appointment and cancellation policies, and general FAQs already published on your website.
- Keep out. Patient records, intake forms, clinical notes, and any document that names or identifies a patient.
- Don't collect. Symptoms, diagnoses, member IDs or prescription details through chat, lead capture, forms, voice calls, email or messaging channels.
Visitors can still type health details into a chat on their own. Ask them not to in your assistant's greeting. If patients are likely to share PHI in your setting and you are a Covered Entity or Business Associate, AskVault is not the right tool today.
To evaluate AskVault on public, non-PHI pages, use the Free plan: 50 messages a month and 5 MB of content, with no time limit.
If you need a BAA
If you work in healthcare and need a BAA, email [email protected] and we will tell you plainly whether we can support your use case.
For the rest of our security posture, see the security overview and how we handle your data.