VerixAi Security and HIPAA Compliance
Your clients' medical records are PHI, and you answer for where they go. Here is how VerixAi protects them, and what we put in writing.
Certifications and safeguards
Is VerixAi independently audited?
Yes. VerixAi is SOC 2 Type I and II Certified, audited by an independent third party, and HIPAA Compliant. SOC 2 verification is available on request.
Will you sign a BAA?
Yes. CorMetrix operates as a HIPAA Business Associate, with Business Associate Agreement terms built into our Terms and Conditions. A standalone BAA is available on request.
Is our data encrypted?
Yes, in transit (TLS 1.2 or higher) and at rest, and each customer's records are kept in their own virtual container.
How do users sign in?
Every account uses multi-factor authentication.
Can CorMetrix staff see our records?
Not as part of normal operations. Only authorized staff, on a need-to-know basis, may access your data, typically to provide technical support. All access falls under HIPAA training, BAA protections, annual compliance checks, access controls, and audit logging.
Your data
Who owns our data?
You do, including uploaded records, queries, and outputs. CorMetrix holds it in confidence under our terms.
Is our data used to train AI?
Your clients' PHI is never used to train or fine-tune VerixAi or any third-party AI model, and our cloud provider is contractually barred from training on customer data. Under our terms, CorMetrix may use de-identified, aggregated data that cannot identify you or any individual to improve the service.
How long do you keep our data?
For as long as you actively use the platform, unless your contract says otherwise or you ask us to delete it.
What happens when an engagement ends?
You can ask us to delete specific cases or all of your data. Data is removed from production systems, with any remaining backup copies retained only for a limited period consistent with disaster recovery requirements before automatic deletion.
What if our VerixAi activity is subpoenaed?
Like any record of your work, activity in VerixAi can be subject to a subpoena or court order, including account activity, chat prompts and responses, analysis outputs, and timestamps. If CorMetrix receives one for your data, our terms require us to notify you where the law allows and to work with you in good faith to limit what is disclosed.
Teamwork and sharing
Who manages access?
Firm Admins manage the firm account and its users. Every user signs in with multi-factor authentication.
How does our team work on a case together?
All members of your team can work on the same cases, from the same uploaded records, if the firm administrator grants access. The firm administrator may revoke this access at any time.
Can teammates see each other's chats?
Only if you share them. Each user's chats, including prompts and responses, stay private unless that user chooses to share them with individual members of your team, and access can be revoked at any time.
Can we share a case outside the firm?
Yes. You can invite an expert, an LNC, or co-counsel, and choose which categories each person can see: Clinical Notes, Imaging, Depositions and Allegations, and Chronology. Access is view only, and you can grant or revoke any category per person at any time. The Access Viewer shows who can see what at any moment.
Is activity logged?
Yes. VerixAi logs logins, access, and changes to case records. We are glad to discuss your specific audit and discovery requirements directly.
Need it in writing?
We will send SOC 2 verification or a signed BAA on request, and walk your team through your audit and discovery requirements.
For the questions to ask any vendor about HIPAA and AI, see HIPAA and AI in Medical Record Review.
← Back to all resourcesVerixAi structures and cites the medical record. It does not determine standard of care or make legal conclusions. Clinical and legal judgment stay with your experts.