What is in place, what is pending, and what is planned, stated plainly. AgenticMD is pre-pilot and processes synthetic test data only.
| Control | Status |
|---|---|
| Business Associate Agreements | In place AI model provider (Anthropic): BAA executed. Pending SMS carrier (Twilio): BAA pending. No PHI is sent through it until executed. |
| Encryption | In place TLS in transit; clinical content and PHI encrypted at rest. |
| Audit trail | In place Immutable log of every authentication, message, and provider action; identifiers hashed. |
| Emergency screen | In place Deterministic pattern matching runs before the AI and routes red-flag symptoms to 911. |
| HIPAA | In place Built to HIPAA requirements; AgenticMD acts as a business associate of the practice. Pending Production hosting on HIPAA-eligible infrastructure under a BAA before launch. Current hosting is for synthetic-data testing only. |
| SOC 2 | Planned, not achieved Planned. AgenticMD has not started or completed a SOC 2 audit. |
Every step below is planned. None is complete.
Gap analysis against SOC 2 Trust Services Criteria.
Point-in-time audit of control design.
Audit of control effectiveness over an observation period.
The AI prepares; a licensed provider decides. Zero autonomous clinical actions.
We'll complete your organization's vendor security review as part of pilot onboarding.
Questions? Contact us or read the privacy policy.