Skip to main content

​
Healthcare Readiness

Crew is designed with healthcare workflows in mind and uses a security-first architecture that can support regulated environments when deployed with appropriate controls. This page outlines our approach to healthcare security and the shared responsibilities involved.
Important Disclaimer: Crew is not HIPAA certified. HIPAA compliance is achieved through a combination of technical controls, administrative safeguards, and organizational policies. This page describes our security architecture and how it can support healthcare deployments, but compliance ultimately depends on how the solution is configured and used within your organization.

​
Our Approach

Crew provides HIPAA-aligned infrastructure and technical controls. However, we recognize that compliance is a shared responsibility that requires:
  1. Technical controls (provided by Crew and configured by you)
  2. Administrative safeguards (your policies and procedures)
  3. Physical safeguards (your facilities and device management)
  4. Organizational requirements (your contracts and training)

​
Technical Safeguards

​
Encryption

ControlImplementation
Data in transitTLS 1.2+ for all connections
Data at restAES-256 encryption for all stored data
Key managementAWS KMS with customer-managed keys (Enterprise)
Recording encryptionEncrypted at rest and in transit

​
Access Controls

ControlImplementation
AuthenticationMFA support, SSO integration
AuthorizationRole-based access control (RBAC)
Session managementConfigurable timeout, secure tokens
API securityScoped API keys, JWT tokens

​
Audit Logging

ControlImplementation
Access logsAll data access logged with user, time, resource
Authentication logsLogin attempts, MFA events
Configuration changesAll settings changes logged
API accessAll API calls logged
RetentionConfigurable, minimum 12 months

​
Data Integrity

ControlImplementation
Database integrityPostgreSQL with ACID compliance
Backup verificationRegular integrity checks
Version controlConfiguration versioning
Audit trailsImmutable audit logs

​
PHI Handling Considerations

​
Minimizing PHI Exposure

Configure Crew to minimize PHI handling: 
{
  "data_handling": {
    "store_transcripts": true,
    "redact_phi_from_transcripts": true,
    "store_recordings": false,
    "anonymize_after_days": 30
  }
}

​
PHI Redaction

Automatic redaction of common PHI patterns: 
{
  "phi_redaction": {
    "enabled": true,
    "patterns": [
      "ssn",
      "date_of_birth",
      "medical_record_number",
      "insurance_id"
    ],
    "replacement": "[REDACTED]"
  }
}

​
What Constitutes PHI

Protected Health Information includes:
  • Names
  • Dates (birth, admission, discharge, death)
  • Phone numbers, fax numbers
  • Email addresses
  • Social Security numbers
  • Medical record numbers
  • Health plan beneficiary numbers
  • Account numbers
  • Certificate/license numbers
  • Device identifiers and serial numbers
  • URLs, IP addresses
  • Biometric identifiers
  • Photographs
Crew’s default configuration may capture some of these during normal operation. Configure appropriately for your use case.

​
Business Associate Agreement

For healthcare deployments, we offer a Business Associate Agreement (BAA):
  • Availability: Enterprise plan
  • Request: Contact sales@usecrew.ai
  • Scope: Covers Crew platform services
  • Subcontractors: Includes BAAs with our service providers
A BAA is a contractual agreement, not a certification. It establishes responsibilities and does not guarantee compliance.

​
Architecture Considerations

Patient Call → Crew Agent → Minimal Data Capture
                    ↓
              EMR Integration (via API)
                    ↓
              PHI Stays in EMR

​
Data Residency

OptionAvailability
US hostingAll plans
EU hostingProfessional+
Dedicated infrastructureEnterprise

​
Network Isolation

Enterprise customers can configure:
  • Private endpoints
  • VPN connectivity
  • IP allowlisting
  • Dedicated resources

​
Customer Responsibilities

To deploy Crew in a healthcare environment, you are responsible for:

​
Administrative Safeguards

  • Designating a security officer
  • Conducting risk assessments
  • Developing policies and procedures
  • Training workforce members
  • Managing business associate relationships

​
Technical Configuration

  • Enabling appropriate security settings
  • Configuring data retention policies
  • Setting up access controls
  • Monitoring audit logs
  • Managing user accounts

​
Organizational Requirements

  • Executing BAA with Crew
  • Maintaining documentation
  • Conducting periodic reviews
  • Reporting and investigating incidents

​
What Crew Provides vs. What You Provide

ResponsibilityCrewCustomer
Infrastructure security✓
Encryption (transit/rest)✓
Access control mechanisms✓
Audit logging✓
BAA (Enterprise)✓
Access control configuration✓
User management✓
Retention policy decisions✓
Risk assessment✓
Workforce training✓
Incident response proceduresSharedShared
Breach notificationSharedShared

​
Risk Considerations

​
Third-Party Processors

Crew uses third-party services that process data:
ProviderData ProcessedBAA Status
OpenAIConversation textCovered under their terms
TwilioCall audio, metadataBAA available
SupabaseAll stored dataBAA available
VercelApplication dataDPA available
Review these providers’ security practices as part of your risk assessment.

​
Voice AI Limitations

Consider these factors for healthcare voice AI:
  • Speech recognition accuracy varies
  • Critical information should be confirmed
  • Agents should not provide medical advice
  • Emergency situations require human routing
{
  "guardrails": {
    "healthcare": {
      "no_diagnosis": true,
      "no_treatment_advice": true,
      "emergency_detection": {
        "enabled": true,
        "keywords": ["emergency", "chest pain", "can't breathe"],
        "action": "immediate_escalation"
      },
      "defer_clinical": {
        "triggers": ["should I take", "is it safe"],
        "response": "For medical advice, please speak with your healthcare provider."
      }
    }
  }
}

​
Compliance Roadmap

We are continuously enhancing our security and compliance posture:
InitiativeStatusTarget
SOC 2 Type IIIn progressQ2 2024
HITRUST assessmentPlannedQ4 2024
Dedicated hostingAvailableEnterprise
Enhanced audit loggingAvailableNow
Customer-managed keysAvailableEnterprise

​
Getting Started

For healthcare deployments:
1

Contact Sales

Reach out to sales@usecrew.ai to discuss your requirements
2

Security Review

We’ll provide documentation and answer security questionnaires
3

Execute BAA

Sign Business Associate Agreement (Enterprise)
4

Configure Environment

Set up with appropriate security settings
5

Train Team

Ensure your team understands proper usage

​
Resources

  • Security documentation: Available on request
  • BAA template: Contact sales@usecrew.ai
  • Security questionnaire: Pre-filled responses available
  • Architecture review: Available for Enterprise

​
Questions

For healthcare security questions:

​
Next Steps