MedicusWhat leaves your machine, and what never does.
Charts stay on your computer. With Privacy on, identifiers are tokenized on your machine before any drafting request, and our relay stores nothing. This page lists controls you can see rather than badges. Every one of them is in the shipping product.
Visit the trust centerPatient data comes first.
Built by a working emergency physician who answers for every chart. Nothing below is a policy we intend to write. Each control is in the product today and can be shown on a call.
Identifiers stay on your machine.
Names, MRNs, dates, phone numbers and addresses become tokens like __PHI_NAME_3f2a__ on your PC before anything is sent. A review dialog shows the exact scrubbed text, and you can redact or keep any item it flagged. When the draft returns, tokens are swapped back locally and underlined so you can see what came home.
- Identifiers replaced on your PC before anything is sent YES
- You see the exact text before it goes YES
- Charts stay on your computer YES
- Nothing is stored on our relay YES
- Tokens restored locally when the draft returns YES
- No microphone, no recording YES
Local chart storage
Charts are saved on the computer that wrote them. Nothing is uploaded to our servers.
Pass-through relay
Drafting requests pass through our relay, and the draft comes back the same way. The relay stores no chart content.
Role-based access
Physician, administrator and owner roles, with an idle lock on any install that uses a login.
Audit log and licence control
Administrative actions go to an append-only log. A licence can be paused or revoked centrally; the app stops at its next launch.
Signed releases
The installer and every update are code-signed, and update manifests are signed with a separate key. Altered packages are refused.
Encrypted in transit
TLS 1.2 and 1.3 only; older versions are refused. The database listens on the local interface and is not reachable from the internet.
Certification status, stated plainly, and the full list of who processes what are on the trust center.
Questions compliance teams ask.
Does Medicus record audio?
No. There is no microphone feature. Medicus works from text you paste or files you drop on a box.
Where are charts stored, and where are your servers?
Charts are stored on the computer running Medicus and are never uploaded to our servers. Our servers run in the United States, in the AWS Ohio region.
What leaves your machine when a draft is written?
With Privacy on, the tokenized text you approved in the review dialog, plus your documentation rules for that box. Nothing is stored along the way. The complete list of who processes what is on the trust center.
Do you have a HIPAA audit?
No government body certifies or audits HIPAA compliance, so no vendor can show you one. What we can give you is a written description of how patient text is handled and our Business Associate Agreement position for your counsel. The trust center lists the controls we can demonstrate.
Will you sign a Business Associate Agreement?
Our position is being finalized. We will give your counsel the current answer in writing before a pilot. OWNER TO CONFIRM
How is access controlled?
Physician, administrator and owner roles, with an idle lock on installs that use a login. Failed sign-ins are rate-limited per address, and refusals are worded identically for a wrong password and an unknown account. A licence can be paused or revoked centrally. Single sign-on and multi-factor login are not available today.
Can our security team review the architecture?
Yes. A security overview and a data-flow description, written for a reviewer rather than a marketer, are available on request. Bring your compliance officer to the demo and we will walk through it line by line.
Review Medicus with your security team.
Request the security overview and data-flow description, or bring your compliance officer to a demo.
Request security documentsOr email support@medicusarc.com.