Direct answers for security and procurement teams.
These answers reflect Vocari's current product and assurance status. Customer-specific obligations are set by executed agreements.
Does Vocari claim HIPAA compliance today?+
No. Vocari has implemented technical safeguards and is completing the administrative, contractual, workforce, and risk-management work required for a defensible HIPAA compliance position. Production PHI use also depends on executed customer and vendor BAAs.
Will Vocari sign a Business Associate Agreement?+
Yes. Vocari provides a customer BAA template for healthcare customers and will execute the agreement before handling PHI in production. The public template becomes binding only when signed or incorporated into an executed customer agreement.
Does Vocari have a SOC 2 report?+
Not yet. SOC 2 is planned after the HIPAA readiness baseline. Vocari does not present its internal controls as an independent audit.
Does Vocari store patient call recordings?+
No. The current Vocari product retains transcripts, structured outcomes, and workflow records. Patient call audio is not retained by Vocari.
Who owns customer and patient data?+
The customer retains its rights in Customer Data and controls patient information submitted to its workspace. Vocari processes that data to provide and secure the contracted service and does not sell it.
How is account access protected?+
Accounts are invite-only, each user has an individual password-protected identity, sessions are time-limited, and workspace roles are enforced by the service.
How are patient requests kept separate?+
Tenant-owned records, provider credentials, events, and application queries are scoped to a validated workspace. The browser cannot select an unverified workspace and retrieve another customer's data.
How does Vocari handle exceptions during a patient interaction?+
Vocari follows practice-approved workflow limits. Uncertain identity, clinical judgment, major procedures, unsupported actions, or configured safety conditions are routed to staff for review.
How can a customer obtain security evidence?+
A qualified customer can request a scoped security review. Vocari will provide available architecture, control, incident-response, risk, and vendor materials appropriate to the review without exposing another customer's information.
How can a customer export workspace data?+
For the current product, exports are handled through Vocari support. An authorized workspace owner requests the export, Vocari verifies the requester and scope, and delivery is arranged through an approved secure method.