> ## Documentation Index
> Fetch the complete documentation index at: https://docs.usecrew.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Healthcare Readiness

> Security architecture designed to support healthcare deployments

# Healthcare Readiness

Crew is designed with healthcare workflows in mind and uses a security-first architecture that can support regulated environments when deployed with appropriate controls. This page outlines our approach to healthcare security and the shared responsibilities involved.

<Info>
  Crew provides HIPAA-aligned infrastructure and technical controls. Achieving compliance requires proper configuration, organizational policies, and a Business Associate Agreement (BAA), available on our Enterprise plan.
</Info>

## Our Approach

Crew provides HIPAA-aligned infrastructure and technical controls. However, we recognize that compliance is a shared responsibility that requires:

1. **Technical controls** (provided by Crew and configured by you)
2. **Administrative safeguards** (your policies and procedures)
3. **Physical safeguards** (your facilities and device management)
4. **Organizational requirements** (your contracts and training)

## Technical Safeguards

### Encryption

| Control              | Implementation                                  |
| -------------------- | ----------------------------------------------- |
| Data in transit      | TLS 1.2+ for all connections                    |
| Data at rest         | AES-256 encryption for all stored data          |
| Key management       | AWS KMS with customer-managed keys (Enterprise) |
| Recording encryption | Encrypted at rest and in transit                |

### Access Controls

| Control            | Implementation                      |
| ------------------ | ----------------------------------- |
| Authentication     | MFA support, SSO integration        |
| Authorization      | Role-based access control (RBAC)    |
| Session management | Configurable timeout, secure tokens |
| API security       | Scoped API keys, JWT tokens         |

### Audit Logging

| Control               | Implementation                                   |
| --------------------- | ------------------------------------------------ |
| Access logs           | All data access logged with user, time, resource |
| Authentication logs   | Login attempts, MFA events                       |
| Configuration changes | All settings changes logged                      |
| API access            | All API calls logged                             |
| Retention             | Configurable, minimum 12 months                  |

### Data Integrity

| Control             | Implementation                  |
| ------------------- | ------------------------------- |
| Database integrity  | PostgreSQL with ACID compliance |
| Backup verification | Regular integrity checks        |
| Version control     | Configuration versioning        |
| Audit trails        | Immutable audit logs            |

## PHI Handling Considerations

### Minimizing PHI Exposure

Configure Crew to minimize PHI handling:

```json theme={null}
{
  "data_handling": {
    "store_transcripts": true,
    "redact_phi_from_transcripts": true,
    "store_recordings": false,
    "anonymize_after_days": 30
  }
}
```

### PHI Redaction

Automatic redaction of common PHI patterns:

```json theme={null}
{
  "phi_redaction": {
    "enabled": true,
    "patterns": [
      "ssn",
      "date_of_birth",
      "medical_record_number",
      "insurance_id"
    ],
    "replacement": "[REDACTED]"
  }
}
```

### What Constitutes PHI

Protected Health Information includes:

* Names
* Dates (birth, admission, discharge, death)
* Phone numbers, fax numbers
* Email addresses
* Social Security numbers
* Medical record numbers
* Health plan beneficiary numbers
* Account numbers
* Certificate/license numbers
* Device identifiers and serial numbers
* URLs, IP addresses
* Biometric identifiers
* Photographs

Crew's default configuration may capture some of these during normal operation. Configure appropriately for your use case.

## Business Associate Agreement

For healthcare deployments, we offer a Business Associate Agreement (BAA):

* **Availability**: Enterprise plan
* **Request**: Contact [sales@usecrew.ai](mailto:sales@usecrew.ai)
* **Scope**: Covers Crew platform services
* **Subcontractors**: Includes BAAs with our service providers

<Note>
  A BAA is a contractual agreement, not a certification. It establishes responsibilities and does not guarantee compliance.
</Note>

## Architecture Considerations

### Recommended Healthcare Architecture

```
Patient Call → Crew Agent → Minimal Data Capture
                    ↓
              EMR Integration (via API)
                    ↓
              PHI Stays in EMR
```

### Data Residency

| Option                   | Availability  |
| ------------------------ | ------------- |
| US hosting               | All plans     |
| EU hosting               | Professional+ |
| Dedicated infrastructure | Enterprise    |

### Network Isolation

Enterprise customers can configure:

* Private endpoints
* VPN connectivity
* IP allowlisting
* Dedicated resources

## Customer Responsibilities

To deploy Crew in a healthcare environment, you are responsible for:

### Administrative Safeguards

* Designating a security officer
* Conducting risk assessments
* Developing policies and procedures
* Training workforce members
* Managing business associate relationships

### Technical Configuration

* Enabling appropriate security settings
* Configuring data retention policies
* Setting up access controls
* Monitoring audit logs
* Managing user accounts

### Organizational Requirements

* Executing BAA with Crew
* Maintaining documentation
* Conducting periodic reviews
* Reporting and investigating incidents

## What Crew Provides vs. What You Provide

| Responsibility               | Crew   | Customer |
| ---------------------------- | ------ | -------- |
| Infrastructure security      | ✓      |          |
| Encryption (transit/rest)    | ✓      |          |
| Access control mechanisms    | ✓      |          |
| Audit logging                | ✓      |          |
| BAA (Enterprise)             | ✓      |          |
| Access control configuration |        | ✓        |
| User management              |        | ✓        |
| Retention policy decisions   |        | ✓        |
| Risk assessment              |        | ✓        |
| Workforce training           |        | ✓        |
| Incident response procedures | Shared | Shared   |
| Breach notification          | Shared | Shared   |

## Risk Considerations

### Third-Party Processors

Crew uses third-party services that process data:

| Provider | Data Processed       | BAA Status                |
| -------- | -------------------- | ------------------------- |
| OpenAI   | Conversation text    | Covered under their terms |
| Twilio   | Call audio, metadata | BAA available             |
| Supabase | All stored data      | BAA available             |
| Vercel   | Application data     | DPA available             |

Review these providers' security practices as part of your risk assessment.

### Voice AI Limitations

Consider these factors for healthcare voice AI:

* Speech recognition accuracy varies
* Critical information should be confirmed
* Agents should not provide medical advice
* Emergency situations require human routing

### Recommended Guardrails

```json theme={null}
{
  "guardrails": {
    "healthcare": {
      "no_diagnosis": true,
      "no_treatment_advice": true,
      "emergency_detection": {
        "enabled": true,
        "keywords": ["emergency", "chest pain", "can't breathe"],
        "action": "immediate_escalation"
      },
      "defer_clinical": {
        "triggers": ["should I take", "is it safe"],
        "response": "For medical advice, please speak with your healthcare provider."
      }
    }
  }
}
```

## Compliance Roadmap

We are continuously enhancing our security and compliance posture:

| Initiative             | Status      | Target     |
| ---------------------- | ----------- | ---------- |
| SOC 2 Type II          | In progress | Q2 2024    |
| HITRUST assessment     | Planned     | Q4 2024    |
| Dedicated hosting      | Available   | Enterprise |
| Enhanced audit logging | Available   | Now        |
| Customer-managed keys  | Available   | Enterprise |

## Getting Started

For healthcare deployments:

<Steps>
  <Step title="Contact Sales">
    Reach out to [sales@usecrew.ai](mailto:sales@usecrew.ai) to discuss your requirements
  </Step>

  <Step title="Security Review">
    We'll provide documentation and answer security questionnaires
  </Step>

  <Step title="Execute BAA">
    Sign Business Associate Agreement (Enterprise)
  </Step>

  <Step title="Configure Environment">
    Set up with appropriate security settings
  </Step>

  <Step title="Train Team">
    Ensure your team understands proper usage
  </Step>
</Steps>

## Resources

* **Security documentation**: Available on request
* **BAA template**: Contact [sales@usecrew.ai](mailto:sales@usecrew.ai)
* **Security questionnaire**: Pre-filled responses available
* **Architecture review**: Available for Enterprise

## Questions

For healthcare security questions:

* **Email**: [security@usecrew.ai](mailto:security@usecrew.ai)
* **Sales**: [sales@usecrew.ai](mailto:sales@usecrew.ai)

## Next Steps

* [Security Overview](/security/overview) — Full security architecture
* [Data Handling](/security/data-handling) — Data processing details
* [Customer Responsibilities](/security/customer-responsibilities) — Your role