.png)
.png)
Powered by Watson Protocol
HIPAA
HIPAA & AI Compliance
HIPAA, Privacy, and Professional Use Statement
This tool is for de-identified clinical note generation.
Please do not enter patient identifiers or protected information such as names, dates of birth, addresses, medical record numbers, phone numbers, or other PHI.
Users are responsible for maintaining full HIPAA compliance when using this system.
ChartLock™ transmits entered text securely through Microsoft Azure OpenAI, which operates within a HIPAA-eligible environment under Microsoft’s compliance framework.
No data entered on this website (ChartLock.com) is stored, cached, or retained, nor is it shared with any third parties.
All text entered into the ChartLock™ platform is processed in real time and permanently deleted once processing is complete.
While processing occurs in a secure Azure environment, users must avoid including any PHI or PII.
This website provides scribe assistance only and does not serve as an electronic medical record system or storage solution.
Use of this platform constitutes acknowledgment that all HIPAA compliance responsibility remains with the user.
A Conversation About Why This Matters
Q: If Azure is HIPAA-eligible and secure, why still avoid PHI?
A: Because good compliance habits start at the source. Even within HIPAA-eligible systems, absolute security can never be guaranteed. Hospitals, clinics, and major health networks have all faced breaches. The safest rule remains: never include identifiable data in dictations.
Q: So what exactly is ChartLock™ designed for?
A: ChartLock™ is built for de-identified scribe processing — converting a physician’s preliminary dictation into a complete, organized, and defensible emergency department chart.
The purpose is to create documentation that’s medico-legally protective, billing-conscious, and requires minimal post-edit adjustment.
Q: Why not use ambient listening AI systems that generate charts automatically?
A: Many of the “hands-free” or “ambient” scribe systems rely on cell phone microphones or other always-listening devices to record audio from the exam room.
Those recordings are then transmitted through non-HIPAA-certified phone operating systems and third-party applications before any medical data is processed.
Each step introduces potential privacy and security vulnerabilities — from the mobile device and operating system to cloud transcription and storage providers.
Beyond the privacy risks, this approach diminishes the human element of medicine. It reduces a nuanced, face-to-face clinical encounter into an audio data feed, stripping
away the physician’s interpretive judgment that comes from years of clinical experience. As physicians, we don’t just record words — we observe body language, tone, eye contact, and interactions between patients and others in the room, all of which help us interpret the true story behind the history.
Our expertise allows us to craft an accurate, meaningful record that reflects the medical reality — not just a literal transcript of speech.
Additionally, recorded audio is legally discoverable in litigation, and transcription errors can create exposure if not corrected promptly.
Ambient systems also raise consent and privacy issues — not every patient or companion in the room has agreed to being recorded, and most mobile devices and networks lack HIPAA-grade security protections.
ChartLock™ avoids all of these pitfalls.
It keeps physicians in control of their own words and workflow — no passive listening,
no cell-phone microphones, and no audio transmission — while maintaining complete
compliance, accuracy, and authorship integrity.
Q: Why emphasize physician control?
A: Physicians are among the most responsible professionals. We don’t discuss patients in elevators, drop labels in parking lots, or misplace discharge papers. ChartLock™ continues that same culture of responsibility — you stay in control of your chart, your words, and your compliance.
Final Note:
Physicians understand confidentiality and professionalism — we don’t discuss patients in public spaces or leave sensitive material unsecured.
This site continues that same ethos: maintain privacy, protect patients, and preserve integrity in documentation.
What We Do
Processing-only, no storage
we generate drafts, then discard them.
De-identified workflow
no PHI/PII should ever be entered.
Single, secure AI engine
data processed only, never stored or shared.
Human in the loop
physicians remain the authors and final reviewers.
Guardrails over 'creativity
protocols and templates minimize hallucinations.
Not an EMR/EHR
we are a drafting tool only.
Step 1
Zero data retention
No saving of prompts, outputs, logs, or metadata.
No backups, archives, or analytics profiles.
If you don’t copy your draft, it’s gone.
Nothing exists to be hacked or exfiltrated.
Step 1
No PHI / PII In, Ever
Users are prohibited from entering PHI, PII, financial data, or restricted information.
Interface reminders reinforce: 'Do not paste identifiers.
Because no PHI is created, stored, or transmitted, a BAA is not required.
Step 1
Secure, Enclosed Processing
Secure, Enclosed Processing
Drafts are generated via a single, vetted AI engine.
No model retraining on user content.
Data is processed in real time, then discarded.
Step 1
Security Principles
Data minimization & purpose limitation — only the minimum text needed to create drafts.
Access & acceptable use — users must comply with HIPAA and institutional policy.
Encrypted transport, no content at rest — nothing is stored.
Explainability & human oversight — physicians must review and validate output.
Lifecycle risk eliminated — nothing is retained, so nothing needs disposal.
Step 1
Guardrails to Minimize Hallucinations
Guardrails force AI to behave like a tool, not a doctor.
No narrative drift — prevents AI from inventing stories
Protocol-first design — fixed templates and standardized sections.
Physician oversight required — drafts are reviewed before entry into the record.
Step 1
Physician Responsibilities
Do not paste PHI/PII into the system.
Review and validate every output.
Copy the final draft into your secure EMR.
Follow your organization’s HIPAA and acceptable-use policies.
Step 1
Intended Use / Legal
Not a medical device.
Not clinical decision support.
Not part of any designated record set.
Drafting assistant only, under licensed clinician oversight.
Step 1
Why Compliance Teams Say “Yes”
No PHI in → no PHI out → no PHI at rest.
Single, vetted AI engine only — no plug-ins or uncontrolled vendors.
No storage, logs, or training reuse.
Human-validated drafts with clear guardrails.
Nothing to breach, subpoena, or retain.
FAQs
Our platform was designed to reduce the documentation burden for physicians through structured, rule-based text generation — while maintaining strict HIPAA alignment. We are not an EMR, not a scribe service, and not a storage system. We simply provide ephemeral draft text that physicians may copy into their secure medical record systems.
We do not store, log, or retain any information. Once a draft is generated and copied, it is immediately discarded.
A frequently asked questions (FAQ) list is often used in articles, websites, email lists, and online forums where common questions tend to recur, for example through posts or queries by new users related to common knowledge gaps.
A frequently asked questions (FAQ) list is often used in articles, websites, email lists, and online forums where common questions tend to recur, for example through posts or queries by new users related to common knowledge gaps.
A frequently asked questions (FAQ) list is often used in articles, websites, email lists, and online forums where common questions tend to recur, for example through posts or queries by new users related to common knowledge gaps.
A frequently asked questions (FAQ) list is often used in articles, websites, email lists, and online forums where common questions tend to recur, for example through posts or queries by new users related to common knowledge gaps.
Client's FAQs
Our platform was designed to reduce the documentation burden for physicians through structured, rule-based text generation — while maintaining strict HIPAA alignment. We are not an EMR, not a scribe service, and not a storage system. We simply provide ephemeral draft text that physicians may copy into their secure medical record systems.
We do not store, log, or retain any information. Once a draft is generated and copied, it is immediately discarded.
A frequently asked questions (FAQ) list is often used in articles, websites, email lists, and online forums where common questions tend to recur, for example through posts or queries by new users related to common knowledge gaps.
A frequently asked questions (FAQ) list is often used in articles, websites, email lists, and online forums where common questions tend to recur, for example through posts or queries by new users related to common knowledge gaps.
A frequently asked questions (FAQ) list is often used in articles, websites, email lists, and online forums where common questions tend to recur, for example through posts or queries by new users related to common knowledge gaps.
A frequently asked questions (FAQ) list is often used in articles, websites, email lists, and online forums where common questions tend to recur, for example through posts or queries by new users related to common knowledge gaps.