Product AI notes Pricing For teams Developers & API Security Standards & compliance
Start free Sign in
Trust · Healthcare

Safeguards a consultation can rest on.

A telehealth call carries protected health information the moment the patient speaks. These are the HIPAA Security Rule safeguards Codexal Meet implements, and the honest limits of what software alone can do.

No software is "HIPAA certified" — there is no such certificate. HIPAA compliance belongs to the covered entity, and a vendor's part is to implement the safeguards and sign a Business Associate Agreement. Codexal Meet implements the technical safeguards below, and a BAA is arranged per customer under an Enterprise agreement. Any vendor selling you a "HIPAA certification" is selling you a story.

45 CFR §164.312

Technical safeguards

The part that is genuinely the software's job.

Safeguard
What Codexal Meet does
Status
Access control§164.312(a)(1)
Unique account per clinician, and a waiting room on every consultation so the clinician admits the patient by name. A meeting identifier is cryptographically random and unguessable.
Implemented
Automatic logoff§164.312(a)(2)(iii)
Sessions expire, and cookies are HttpOnly, Secure and SameSite so a session cannot be lifted from a shared clinic machine by another site.
Implemented
Encryption and decryption§164.312(a)(2)(iv)
Media is encrypted with DTLS-SRTP between browsers; everything else moves over TLS 1.2+ and rests on encrypted volumes.
Implemented
Audit controls§164.312(b)
Sign-ins, admissions and participation are recorded, so who joined a consultation and when is answerable after the fact.
Implemented
Integrity§164.312(c)(1)
SRTP authenticates every media packet, so audio cannot be altered in flight without detection. Records of a consultation are not editable by third parties.
Implemented
Person authentication§164.312(d)
Password authentication with bcrypt storage and rate limiting; SSO against the organisation's identity provider on Enterprise.
Implemented
Transmission security§164.312(e)(1)
This is the safeguard most video tools compromise on. Media never traverses our servers in decrypted form, and a TURN relay used on a restrictive hospital network forwards ciphertext it cannot read.
Implemented
Minimum necessary§164.502(b)
No server-side recording. Captions are opt-in per person — a clinician can hold a consultation with nothing transcribed at all, which is the smallest possible PHI footprint.
Implemented
45 CFR §164.308

Administrative safeguards

Safeguard
What Codexal Meet does
Status
Security management§164.308(a)(1)
A risk register with owners and treatment plans, reviewed quarterly, and a sanction process for policy violation.
Aligned
Assigned responsibility§164.308(a)(2)
A named individual at Codexal is accountable for security policy and for decisions that accept risk.
Aligned
Workforce security§164.308(a)(3)
Least-privilege production access granted per person, reviewed periodically, and revoked on the last working day.
Aligned
Training§164.308(a)(5)
Security induction for engineers with production access, refreshed when practice changes.
Aligned
Incident procedures§164.308(a)(6)
Documented, with an owner, a severity scale, and notification to affected covered entities without unreasonable delay.
Aligned
Contingency plan§164.308(a)(7)
Daily encrypted backups with restore tests, and a recovery objective for the web and signalling tiers. A consultation already in progress survives a signalling outage because the call is peer to peer.
Aligned
Business Associate Agreement§164.308(b)(1)
Arranged per customer under an Enterprise agreement. Talk to us before you start seeing patients on the platform, not after.
Aligned
45 CFR §164.310

Physical safeguards

Facility access

Delegated to our hosting provider, which controls and monitors physical access to the data centre. Codexal staff have no physical access to the servers.

Workstation security

Company devices are encrypted at rest and lock automatically. No PHI is held on removable media, and no customer data is printed.

Device and media disposal

Deletion is logical and verified against both the live database and the backup rotation; physical media decommissioning is the provider's documented process.

Shared responsibility

The half that is yours.

A platform can encrypt a consultation. It cannot stop a clinician taking one in a corridor, or emailing a recap to the wrong address. These are the practices that decide whether a compliant tool is used compliantly.

We would rather set this out plainly than let a security page imply that buying software discharges an obligation.

  • Sign the BAA before the first patient consultation, not after.
  • Take consultations in private and use headphones — the most common breach in telehealth is someone overhearing.
  • Decide your caption policy. Captions produce a transcript containing PHI; consider whether each consultation needs one, and set the retention period accordingly.
  • Tell the patient when captions or recording are on, and record their agreement in the file.
  • Check the recap before it goes in the record, and correct it. An AI summary is a draft, not a clinical note.
  • Keep the waiting room on so nobody joins a consultation unannounced.
Questions

From clinics and telehealth providers.

Is Codexal Meet HIPAA compliant?
A software product cannot be HIPAA compliant on its own — compliance belongs to the covered entity, and the vendor's role is to implement the Security Rule safeguards and sign a Business Associate Agreement. Codexal Meet implements the technical safeguards of 45 CFR §164.312: access control, automatic logoff, encryption, audit controls, integrity and transmission security. The BAA is arranged per customer under an Enterprise agreement.
Will you sign a Business Associate Agreement?
Talk to us. The safeguards a BAA relies on are already in the product; the agreement itself is handled per customer under an Enterprise contract. Arrange it before you begin seeing patients on the platform.
Is the consultation itself recorded?
Not by us. There is no server-side recording, so no audio or video of a consultation exists in our infrastructure to be disclosed or breached. If a participant presses record, the file is written to that person's own device and the room shows a red indicator to everyone while it runs.
Do captions create PHI?
Yes, and that is why they are opt-in per person rather than on by default. A transcript of a consultation is protected health information. You can hold consultations with captions off entirely, or leave them on and set a short retention period — 14 days is the default and it can be shortened for your organisation.
What does the patient have to install?
Nothing. A patient opens the link, types their name, and waits in the waiting room until the clinician admits them. It works in Safari on iPhone and Chrome on Android, which removes the most common reason a telehealth appointment fails to start.
Can a second specialist or a family member join?
Yes, and the waiting room stays on for them too, so the clinician admits each person by name. Everyone in the room is visible in the participant list for the whole consultation.

Talk to us before your first consultation.

The BAA, the retention period and the caption policy are a fifteen-minute conversation.

info@codexal.co Codexal Meet for healthcare