Chartnote - Revolutionizing Medical Documentation with AI Scribe
Product
Features
Resources
Specialties
Segments

Chartnote Privacy and Security Overview
(HIPAA · SOC 2 Type II · GDPR · PIPEDA · CCPA)

September 2026

At Chartnote, the trust of clinicians and patients is our top priority, and security is built into everything we create. Chartnote undergoes an annual independent SOC 2 Type II examination and maintains compliance programs for HIPAA, GDPR, PIPEDA, and CCPA, monitored continuously. We also apply the same safeguards for clinicians in Australia, consistent with the Australian Privacy Principles.

Governance and Compliance

  • Chartnote has a designated Privacy Officer and a designated Security Officer responsible for our privacy and security programs.
  • We undergo an annual SOC 2 Type II examination by an independent auditor; the report is available under NDA through our Trust Center.
  • Regular risk assessments, policy reviews, and third-party penetration tests keep our controls current.

Personnel Security

All Chartnote team members with access to production systems:

  • Undergo background checks before being granted access.
  • Complete annual security awareness training covering HIPAA, GDPR, PIPEDA, privacy, and information handling.
  • Work from centrally managed, encrypted devices and access systems only through multi-factor authentication under least-privilege, role-based permissions.

Secure Development

  • All code changes are peer-reviewed and pass automated testing before deployment through our CI/CD pipeline.
  • Infrastructure is managed as code, with all changes reviewed before release.
  • Engineers complete secure development training.
  • Continuous vulnerability scanning and periodic independent penetration testing.

Cloud Hosting and Data Residency

  • All data is hosted and processed in Amazon Web Services data centers located in the United States. Customer data never leaves US regions.
  • We maintain a HIPAA Business Associate Agreement and a Data Processing Agreement with AWS.
  • Our infrastructure is designed for high availability, with encrypted backups that are regularly tested.

Encryption

  • All data is encrypted in transit (TLS 1.2 or higher) and at rest (AES-256), including backups.

Access Logging and Monitoring

  • Access to systems that store or process patient information is logged, including access to clinical records, and monitored for anomalies.
  • We maintain an incident response program and notify affected customers of security incidents as required by our Business Associate Agreement and applicable law.

Vendor Management

  • Every vendor that may process patient information signs a Business Associate Agreement or equivalent data processing terms with Chartnote and is reviewed as part of our vendor risk program.
  • Our current subprocessors are listed at trust.chartnote.com, where you can subscribe to change notifications.

Artificial Intelligence

  • Chartnote’s AI features are powered by providers operating under Business Associate Agreements, with zero-data-retention or equivalent terms so that clinical content is not kept beyond what is needed to return a result.
  • Patient information and clinical content are never used to train AI models — not by Chartnote and not by our providers.
  • AI output is always reviewed and approved by the clinician before use. Chartnote’s AI does not make decisions about patients.

Patient Information and Retention

  • Notes and recordings are encrypted and stored in accordance with HIPAA, GDPR, and PIPEDA requirements.
  • Notes can be deleted manually at any time or set to delete automatically after 1–30 days. Recordings can be set to delete automatically after 1–30 days. Team and enterprise workspaces can configure retention centrally.
  • Chartnote is a documentation tool, not an electronic health record; your EHR remains the system of record.


Learn More



Security or compliance questions: privacy@chartnote.com. General support: help@chartnote.com.

Chartnote, Inc., 2062 John Jones Rd, Ste 130, Davis, CA 95616