Security and compliance.
ScoutIQ works inside your practice management system, bank and books, so it is built to the rules that govern patient data: HIPAA with a signed BAA, encryption, US hosting, and a record of every access and every change.
How your data is protected.
The controls behind every ScoutIQ account.
HIPAA, with a BAA for every customer
ScoutIQ handles protected health information as a business associate and signs a Business Associate Agreement with every customer.
Encrypted in transit and at rest
Practice and patient data is encrypted in transit (TLS) and at rest.
Hosted in the United States
Customer data is hosted in US regions only.
Card payments on PCI DSS infrastructure
Patient card payments run on PCI DSS secure payment infrastructure through ScoutIQ’s payment partners.
Access by role and location
Owners, office managers, billers and front desks each see the locations and work their role allows.
Every access and change logged
Access is logged and audited per user. Every change ScoutIQ makes in your practice management system is recorded: what changed, when and why.
Changes you can reverse
A posting ScoutIQ made can be undone from the same record, and anything outside the rules you set goes to a person instead of being posted.
Claims stay with you
ScoutIQ never submits or resubmits claims. It starts once the payer has paid or denied, and your team keeps the clearinghouse and the claim.
Your data, in detail.
What a compliance review usually asks next. The privacy policy has the full terms.
- What ScoutIQ AI can change in your PMS
- ScoutIQ AI posts insurance payments and adjustments to the PMS ledger, updates claim notes and statuses, adjusts patient balances and books the matching journal entry in your accounting system. Every change is logged with who, what and when, and can be reversed. A person on your team approves anything that moves money.
- AI and your data
- Your data and your patients’ PHI are never used to train AI models that are shared with or made available to other customers. AI model providers process data only to run the service, under agreements with confidentiality terms and a BAA wherever PHI is involved. Published benchmarks use only de-identified, aggregated statistics that cannot identify a practice or a patient.
- Who processes your data
- Cloud hosting in the United States, the payment partners (Stripe, Square, Affirm and Klarna), a text messaging provider, an email provider, analytics, support chat and AI model providers, each under a written agreement, with a BAA where PHI is involved.
- Retention and deletion
- PHI is kept as your BAA and agreement require. When the agreement ends, it is returned or destroyed within 30 days, as the BAA provides. Logs and backups are kept only as long as security, legal and backup needs require, then deleted on a schedule.
Read the privacy policy for every term.
A few questions.
Yes. ScoutIQ is HIPAA compliant and signs a Business Associate Agreement with every customer. Data is encrypted in transit and at rest, hosted in US regions only, and every access is logged per user.
In US regions only. ScoutIQ reads from the practice management systems, banks and accounting systems you connect, and stores what it needs to post, collect and reconcile, encrypted at rest.
Card payments run on PCI DSS secure payment infrastructure through ScoutIQ’s payment partners. ScoutIQ posts each payment to your practice management system and reconciles it to the bank deposit.
Yes. Every change ScoutIQ makes in your practice management system is logged with what changed, when and why, and a posting can be reversed from the same record. Anything outside the rules you set goes to a person rather than being posted.
Email security@scoutiq.ai. The same contact is published in the standard security.txt file at scoutiq.ai/.well-known/security.txt.
Questions from your compliance team?
Bring them to a 30-minute demo, or email security@scoutiq.ai.A Business Associate Agreement comes with every account.
Book a demoIncludes a free 30-day trial on your own data.
Last reviewed