HIPAA, BAA and security at Pogosh CDS
How protected health information moves through Pogosh, who signs which agreement, what we store (almost nothing), and what is not covered.
At a glance
| Business Associate Agreement | Yes. Your organization reviews and signs it online during onboarding, together with the pilot terms. |
| Where processing runs | Amazon Web Services, US East (N. Virginia), on HIPAA-eligible services (Lambda, API Gateway, DynamoDB, Secrets Manager, CloudWatch), under the AWS Business Associate Addendum. |
| Language model | OpenAI API under OpenAI's Business Associate Agreement, with Zero Data Retention: prompts and outputs are not stored by OpenAI and are not used for training. |
| Clinical content stored by Pogosh | None. Notes, chart extracts and responses are processed in memory and discarded when the request ends. |
| Logs | Error class, endpoint, request id and timing only. No request bodies, note or chart text. Kept 90 days. API gateway access logging is off. |
| Encryption | TLS 1.2 or higher in transit; AES-256 at rest for every stored table. |
| Access | One API key per partner, stored only as a SHA-256 hash, with an hourly rate limit, a monthly model-call budget and an optional expiry. |
| Incident notice | To your designated contact within five calendar days of discovery (contractual; HIPAA allows business associates up to 60). |
| SOC 2 | Pogosh does not hold a SOC 2 report. The controls that apply are described on this page and in Schedule A of the partner agreement. |
| FDA status | Not FDA-cleared. Advisory decision support for licensed clinicians; a clinician reviews every output and can override it. |
| Public demo (pogosh.com/try) | Not covered by a BAA. Do not enter patient identifiers there. PHI belongs only on the API at api.pogosh.com, after the BAA is signed. |
Who signs what
HIPAA requires a written agreement before a business associate handles protected health information (PHI) for a covered entity, and requires business associates to have the same kind of agreement with their own subcontractors.1–4 Where Pogosh sits depends on who connects to it:
- A practice or health system using Pogosh directly is the covered entity; GigHz LLC (the company behind Pogosh CDS) is its business associate.
- An EHR or software company embedding Pogosh is usually a business associate of its customers; GigHz is then that company's subcontractor, and the company's own agreements with its customers must allow the arrangement.
Your organization chooses which role applies when it signs the BAA during onboarding. Downstream, GigHz holds its own agreements with the two subcontractors that touch PHI: the AWS Business Associate Addendum8 and OpenAI's Business Associate Agreement for the API.10
What happens to data in a request
| What you call | What you send | Sent to the language model? |
|---|---|---|
| Reference lookups (conditions, procedures, triage records, calculators) | Search terms, ids, calculator inputs | No |
| Symptom evaluation | Symptom terms; optionally age, sex, vitals | No |
| Emergency check, note analysis and note writing | Clinical note text (up to 8,000 characters) | Yes |
| Chart-read copilot | A chart extract (problems, medications, results, notes; age and sex only for demographics) | Yes |
| Feedback, ratings, usage signals | Response and item ids, a rating or action, an optional comment | No |
Before any model call, structured identifier fields are removed and common identifier patterns (record numbers, SSN-format numbers, phone numbers, labelled birth dates, email addresses) are redacted from free text. That is data minimization, not HIPAA de-identification:6 narrative text can still contain identifiers, which is why the model runs under a BAA. Partners are asked not to send names, dates of birth, record numbers or contact details in structured fields.
What Pogosh stores, and for how long
| Store | Contents | Kept |
|---|---|---|
| Request processing (memory) | The request and response while they are being processed | Discarded at the end of the request |
| Request log | Hashed key id, endpoint, condition ids, counts, duration | 30 days |
| Pilot measurement and feedback | Ids, counts, ratings, actions; clinician comments with identifiers scrubbed server-side | The pilot, then up to 12 months |
| API keys | SHA-256 hash of each key, client name, limits, expiry | Life of the key |
| Partner onboarding | Business contact details, the confirmations, and copies of the signed agreements | Life of the relationship |
| Application logs | Error class, endpoint, request id, timing; never bodies or note text | 90 days |
None of these stores holds clinical content. Stored tables are encrypted at rest (AES-256) with 35-day point-in-time recovery. When a partnership ends, its key is deactivated and its rows are deleted within 30 days of request, with a written certification of what was deleted.
Security controls
- Transport: HTTPS only (TLS 1.2+); plain HTTP is redirected.
- Authentication: a 43-character random API key per partner, stored only as a hash; keys can be disabled or expired at any time.
- Limits: per-key hourly rate limits and monthly model-call budgets.
- Secrets: the model-provider credential lives in AWS Secrets Manager, never in code.
- Administration: AWS account access is limited to GigHz's administrator, and administrative actions are recorded by AWS CloudTrail.
- Human access to clinical content: none in the ordinary course, because none is stored.
If something goes wrong
GigHz notifies a partner's designated contact within five calendar days of discovering a security incident or breach involving that partner's data, with what is known at the time, and supplements as the investigation proceeds. HIPAA's outer limit for a business associate is 60 days from discovery;5 the agreement sets a shorter one. Security reports: support@pogosh.com.
What is not covered
- The free demo at pogosh.com/try runs on the public website, not on the API, and is not covered by a BAA. Paste notes there only without patient identifiers.
- The website's contact and access forms and support email are for business contact only. Do not include patient information.
- Clinical judgment. Pogosh is advisory decision support, not an FDA-cleared device. The treating clinician remains responsible for clinical decisions.
Frequently asked questions
Is Pogosh CDS HIPAA compliant?
Pogosh is built to be used with protected health information under HIPAA: GigHz LLC signs a Business Associate Agreement, PHI is processed only on HIPAA-eligible AWS services under the AWS Business Associate Addendum, the language model runs under OpenAI's Business Associate Agreement with zero data retention, and no clinical content is stored. HIPAA compliance is shared: your organization remains responsible for its own obligations, and the free public demo is not covered.
Will Pogosh sign a BAA?
Yes. Partners review and sign the Business Associate Agreement online during onboarding, choosing whether Pogosh acts as their business associate or as a subcontractor of their own business associate relationship.
Does Pogosh store patient data?
No clinical content is stored. Notes and chart extracts are processed in memory and discarded at the end of each request. Pogosh keeps only identifiers, counts, ratings and identifier-scrubbed clinician comments for measurement, plus logs without request bodies.
Is patient data used to train AI models?
No. Pogosh does not train models on partner data, and the OpenAI API organization Pogosh uses has Zero Data Retention: prompts and outputs are not stored by OpenAI and API data is not used for training.
Which subcontractors handle PHI?
Two: Amazon Web Services (hosting and processing, US East region) and OpenAI (language model API). Each is covered by a Business Associate Agreement with GigHz LLC. Partners get 30 days' written notice before any new subcontractor that would process PHI.
Where is data processed?
In the United States, on AWS in the US East (N. Virginia) region.
Can I paste patient notes into the free demo?
Not with patient identifiers. The demo at pogosh.com/try is a public website feature without a BAA. Use the API at api.pogosh.com, after signing the BAA, for anything containing PHI.
Does Pogosh have SOC 2?
Pogosh does not hold a SOC 2 report. The controls that apply are described on this page and in Schedule A of the partner agreement.
Is Pogosh FDA-cleared?
No. Pogosh is advisory clinical decision support for licensed clinicians. A clinician reviews every suggestion and can accept, change or override it; nothing runs automatically.
How fast are breaches reported?
Within five calendar days of discovery to the partner's designated contact under the agreement, which is shorter than HIPAA's 60-day outer limit for business associates.
Building on Pogosh? The API integration guide covers every endpoint. Pricing is at pogosh.com/api; questions go to support@pogosh.com.
Want to see it first? Try it free with a note that has no patient identifiers.
References
- 45 CFR 160.103 — Definitions (business associate, covered entity, subcontractor)
- 45 CFR 164.502(e) — Disclosures to business associates
- 45 CFR 164.504(e) — Business associate contracts
- 45 CFR 164.308(b) — Business associate contracts and other arrangements (Security Rule)
- 45 CFR 164.410 — Notification by a business associate
- 45 CFR 164.514 — De-identification of protected health information
- HHS — Business Associate Contracts: sample provisions
- AWS — HIPAA compliance
- AWS — HIPAA eligible services reference
- OpenAI — Getting a Business Associate Agreement for the OpenAI API
This page describes how Pogosh handles data; it is not legal advice. Your organization's own HIPAA obligations depend on its role and agreements.