Written for your security review.
Soma Recoup is HIPAA compliant. This page is the evidence behind that sentence: who signs what, where protected health information goes, and every company that touches it — with its agreement status.
Ten answers most security reviews open with.
| Is there a BAA? | Yes. Signed and countersigned before your first account exists. Accepting the terms of service does not execute it. |
|---|---|
| Who is the covered entity? | You. Soma is your business associate. |
| Where is PHI processed? | The United States only. Google Cloud us‑east4 and Amazon Web Services us‑east‑1. Resource location is enforced by organization policy, not by convention. |
| Is any of it processed in Canada? | No. The Canadian deployment is separate, under a separate agreement. U.S. and Canadian data are never mixed. |
| Who are the subprocessors? | Four that can touch PHI, listed in full below, each with its agreement status. |
| Do AI models train on our data? | No. Your clients' data is never used to train any AI model, ours or a provider's. Prompts and completions are not retained by the model providers. |
| Is data encrypted? | TLS in transit. Customer‑managed keys at rest. Column‑level encryption on sensitive note fields. |
| How long is it kept? | You set a destroy date per case, 7 to 180 days, default 30. Audit records are kept six years, as HIPAA requires. |
| Breach notification? | Assessed under HIPAA's four‑factor test and reported to your practice within the window in your BAA, never later than HIPAA's 60‑day maximum. |
Your practice is the covered entity. Soma Health Solutions Inc. creates, receives, maintains and transmits protected health information on your behalf, which makes Soma your business associate and makes the HIPAA Security Rule apply to Soma directly, not only through you.
Soma is a drafting workspace. It is not a clinic, not a system of record, and not a provider of care. Clinic seats are invited by your administrator and work under the clinic's BAA.
One agreement, counsel‑drafted, signed by your practice and countersigned by Soma. Governing law is Delaware. Signed records are kept six years past termination.
Before any clinical information is uploaded. U.S. self‑service signup is switched off for exactly this reason: the Security Officer creates your first account only after the signed copy is on file. There is no path into the product that skips the agreement.
Every provision the rule requires at §164.504(e)(2):
The agreement names the AI subprocessors, states that inference happens inside the United States, and carries the commitment that model providers do not retain your prompts or completions and do not use your regulated data to train, fine‑tune or improve any model. It also gives you the right to request the subprocessor agreements.
A dedicated United States environment. Google Cloud us‑east4 (Northern Virginia) runs the application, database, document storage, logs, de‑identification and transcription. Amazon Web Services us‑east‑1 is called per request for text extraction and model access. Both are under executed Business Associate Agreements.
On model routing: Soma's Amazon Bedrock access uses a United States cross‑region inference profile. Storage and the request path are in us‑east‑1, and inference may execute in any Amazon Web Services region within the United States. No inference is performed outside the United States.
Every company that can touch protected health information in the U.S. service, what it does, what it sees, where it runs, and the agreement that covers it. We notify you before adding a subprocessor that will receive clinical information.
| Who | What it does | What it touches | Where | Agreement |
|---|---|---|---|---|
| Google LLC — Google Cloud | Application, database, document storage, logs, de‑identification, transcription, DNS | PHI and account data | us‑east4 | BAA executed |
| Google LLC — Vertex AI | Google large‑language model access | Identifier‑reduced text | us‑east4 | Covered by the same Google BAA |
| Amazon Web Services | Text extraction (Textract); model access (Bedrock); staging storage; service functions | Documents at extraction; identifier‑reduced text at inference | us‑east‑1; Bedrock inference within the United States | BAA executed, active since April 1, 2026 |
| Anthropic, PBC | Claude models, reached only through Amazon Bedrock — never contacted directly by Soma | Identifier‑reduced text | Within the United States, through AWS | Covered by the AWS BAA. No retention, no training. |
These sit outside the clinical data path on purpose. Each carries a written determination on file that it cannot receive PHI in its engagement.
| Who | What it does | What it touches | Status |
|---|---|---|---|
| Resend | Account and sign‑in email | Your work email address. Never clinical content. | Signed no‑PHI determination |
| Stripe | Subscription billing | Billing identifiers only | Written determination on file |
| GitHub | Source code hosting | No PHI. No build pipelines are installed; releases are run by a named operator. | Signed no‑PHI determination |
The de‑identification service and the error store are not vendors. They run on Soma's own infrastructure under the Google BAA — which is why they are self‑hosted rather than bought.
TLS in transit everywhere. Customer‑managed keys at rest. Column‑level encryption on sensitive note fields.
Individual named accounts, never shared logins. Two‑factor authentication available. Automatic sign‑out. Row‑level security in the database. Soma staff do not browse customer content; administrative access is individually attributed, logged and alerted.
An append‑only application audit trail. Cloud audit logs kept six years. Reviewed monthly. Extracts for your practice on request.
Your clients' data is never used to train any AI model, ours or a provider's. Requests are processed in memory and not retained by the providers.
Point‑in‑time recovery. A full restore and a disaster‑recovery exercise have been run, not merely documented.
External scan of the production front door, re‑tested after fixes: zero high findings, September 2026. Critical patched within 7 days, high within 30.
A named Privacy and Security Officer, and a trained backup who holds no standing access. Training on hire and every year.
| Case material | A destroy date you set, 7 to 180 days from last activity. Default 30. Deletion is immediate; there is no recycle bin. |
|---|---|
| AI working sessions | Deleted within 7 days of completion. |
| Session audio | Never stored. Transcribed in memory. |
| Extraction staging copy | Expires within one day. |
| Audit records | Six years, as HIPAA requires. |
| When you leave | You choose return or destruction of everything we hold, and we confirm it in writing. Reading and downloading never stop, even if billing lapses. |
Report a suspected incident to security@soma-recoup.com. Soma triages, contains, assesses under HIPAA's four‑factor risk test, and notifies your practice within the window written into your BAA — never later than HIPAA's 60‑day maximum.
On request Soma produces a client's records in readable electronic form, applies amendments you approve, and supplies the disclosure log. Because cases are stored under aliases you choose, you supply the case identifier.
42 CFR Part 2 programs: tell us before onboarding so the Part 2 terms are in place first.
Soma’s HIPAA program — seventeen signed policies and forty‑five evidence artifacts — completed a gap analysis with Carbide, a compliance advisory firm: all 74 Security Rule controls in its framework implemented, October 2026. An external scan of the production front door, re‑tested after fixes, returned zero high findings in September 2026.
Google Cloud and Amazon Web Services hold SOC 2 and ISO 27001 for the infrastructure layers they operate beneath Soma.
Write to hello@soma-recoup.com and we send, under a mutual non‑disclosure agreement where you prefer:
For the website, cookies, your own personal information and our notice of AI use, see the privacy policy.
Book a short video call. If your practice has a questionnaire, send it ahead and we will have it answered before we meet.
Book a session
Soma Recoup