HIPAA: United States

Maestra encrypts sensitive stored patient and clinical values on-device and protects transport with TLS. Necessary plaintext still passes transiently through the relay and contracted processors for transcription, AI, import, retrieval, and PDF tasks. That processing boundary matters under HIPAA.

Current limitations

• Maestra does not currently offer a signed Business Associate Agreement.
• The current audio-transcription processor arrangement is not covered by a Maestra BAA for US covered entities.
• Maestra does not provide a separate HIPAA-specific breach-notification procedure or HIPAA-ready deployment path.

Not suitable for covered PHI without required BAAs

A HIPAA covered entity or business associate should not use Maestra for PHI unless its own qualified counsel confirms that the required agreements and safeguards are in place. The current service does not supply that BAA coverage.

Account export and deletion are not substitutes for a BAA. Deletion removes Maestra-held records and wrapped key material but does not erase user exports, backups, or other-device copies.

For statutory privacy matters, contact Diogo Carpanedo do Carmo at [email protected]. For product support, use [email protected].

Not legal advice

HIPAA status depends on the entity, data, contracts, and actual workflow. Consult qualified US healthcare privacy counsel.