HIPAA
OdysseyGPT is not HIPAA compliant and does not sign BAAs
OdysseyGPT is not HIPAA compliant. It is not HIPAA certified and does not sign Business Associate Agreements (BAAs). Read this before you upload any protected health information (PHI).
Last reviewed:
Overview
HIPAA sets the standard for protecting patient data. A covered entity that shares protected health information (PHI) with a vendor needs a Business Associate Agreement (BAA) with that vendor. OdysseyGPT is not HIPAA compliant. It is not HIPAA certified and does not sign Business Associate Agreements (BAAs). Do not upload PHI to OdysseyGPT. Teams can still use it for documents with no PHI, such as policies, procedures and contracts. Those documents get the access controls and audit log described below.
Key Takeaways
- OdysseyGPT is not HIPAA compliant, does not sign BAAs and is not deployed on-premises. Do not upload PHI.
- OdysseyGPT is not HIPAA compliant. It is not HIPAA certified and does not sign Business Associate Agreements (BAAs). OdysseyGPT is therefore not suitable for PHI.
- OdysseyGPT is not HIPAA compliant. It is not HIPAA certified and does not sign Business Associate Agreements (BAAs).
Key requirements
- Business Associate Agreement: OdysseyGPT is not HIPAA compliant. It is not HIPAA certified and does not sign Business Associate Agreements (BAAs). OdysseyGPT is therefore not suitable for PHI.
- Access controls: Workspace roles (Owner, Admin, Member and Guest) control who can see and change what.
- Audit trail: Each workspace keeps a tamper-evident (hash-chained) audit log. It records sign-ins, document uploads, views, downloads and deletions, exports, questions and answers.
- Encryption: Data is encrypted in transit with HTTPS (TLS). Our hosting and storage providers encrypt data at rest. Cloudflare R2 encrypts every stored file with AES-256.
- Disposal: When you delete a document, we remove it for good. That includes its extracted content and its stored original file.
Relevant document types
- Policies and procedures
- Vendor and service contracts
- Training and compliance materials
- Internal control documentation
Frequently asked questions
Is OdysseyGPT HIPAA compliant?
No. OdysseyGPT is not HIPAA compliant. It is not HIPAA certified and does not sign Business Associate Agreements (BAAs). OdysseyGPT does not hold SOC 2, ISO 27001, HIPAA, PCI DSS, FedRAMP or any other security certification or attestation today.
Does OdysseyGPT sign BAAs?
No. OdysseyGPT does not sign Business Associate Agreements, so do not upload protected health information (PHI).
Can OdysseyGPT be deployed on-premises or in our own cloud to keep PHI in our environment?
No. OdysseyGPT is a managed, multi-tenant cloud service. We don't offer customer VPC, on-premises, air-gapped or dedicated single-tenant deployments.
Where would our documents be stored?
OdysseyGPT is hosted on Render in the United States (US-East, Virginia). Uploaded files are stored in Cloudflare R2.
How are audit logs protected?
Each workspace keeps a tamper-evident (hash-chained) audit log. It records sign-ins, document uploads, views, downloads and deletions, exports, questions and answers. Audit records are kept for the life of the workspace.