HIPAA Compliance at Ava

Last Updated: @January 15, 2026

What is HIPAA?

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) is a United States federal law that establishes standards to protect the privacy and security of protected health information. This includes requirements to maintain reasonable and appropriate administrative, physical, and technical safeguards to ensure the confidentiality, integrity, and security of electronic protected health information (ePHI).

Our Shared HIPAA Commitment

Maintaining HIPAA compliance, and ensuring the security of ePHI, is a joint commitment between customers and Ava. Customers subject to HIPAA requirements can use Ava in support of compliant workflows; however, customers acting as covered entities or business associates have an obligation under HIPAA, independent of Ava, to implement the appropriate administrative, physical, and technical safeguards to ensure the security of ePHI.

Ava provides a solution that empowers customers to benefit from communication access in their conversations in a secure and compliant manner. Below, we have provided additional information to help customers ensure their use of Ava supports their efforts to maintain HIPAA compliance.

Business Associate Agreements

Ava Enterprise Customers may be interested in executing Ava’s Business Associate Agreement (BAA) if they are subject to HIPAA and intend to store or process ePHI in their Ava environment. Ava’s BAA is a contract between Ava and a customer acting as a covered entity or business associate under HIPAA, which governs how a customer’s ePHI in the Ava platform is protected in compliance with HIPAA. It is the customer’s responsibility to determine whether a BAA is required for their use case. To begin this process or request additional information, please contact a member of your account team. Enabling HIPAA compliance for your organization’s usage of Ava and the execution of a BAA is only available to customers on the Enterprise plan. For more information and to adjust your organization’s plan, please reach out to your sales representative. Please note that if you decide to later downgrade your plan, you will no longer be covered by the executed BAA.

Requirements for HIPAA Customers

For a customer’s use of Ava to be covered by the Ava BAA, the customer and customer’s permitted users must comply with the following requirements:

AI Captions | Ava's AI speech-to-text service processes audio to generate text transcripts. When using this service:
- Ensure that any audio who may contain ePHI are uploaded or recorded only through our secure, encrypted mobile and web application function.
- Do not include patient names or other direct identifiers in file names or metadata.
- Set Conversation Mode to Private mode to screen for users joining the conversation who may not be authorized to be seeing ePHI.
- Be aware that our AI system may occasionally misinterpret medical terminology. Review AI-generated transcripts for accuracy before use in medical records.
Scribe Captioning | For human-generated captions and transcripts:
- Use our secure messaging system when communicating with human captioners about ePHI-containing content.
- Scribe Captioners are instructed to put “Patient A” instead of real-names in transcripts when possible.
File Storage | ePHI must only be in transcripts within the Ava platform, who are encrypted. Do not store ePHI in user profile or transcript titles.
Sharing Transcripts | Ava allows sharing of completed transcripts. When sharing:
- Use access controls to limit transcript visibility to authorized personnel only.
- Do not use the public sharing link feature for any transcripts containing ePHI.
Customer Support | When contacting Ava support:
- Do not include ePHI in screenshots or support tickets.
- Refrain from sharing ePHI with Ava representatives on calls, in emails, or through chat support.
Integrations | Customers may integrate Ava with other systems like video conference calling platforms that are vetted to be HIPAA compliant. They are nonetheless responsible for ensuring such integrations comply with HIPAA requirements and that they have correctly activated the HIPAA agreements with these integrations. Be aware that Ava cannot ensure the security of data, including ePHI, outside of our platform.
Mobile App | When using the Ava mobile app:
- Enable device-level encryption and strong authentication.
- Do not download ePHI-containing transcripts to local storage on mobile devices.
Automations | Ava Automations allow users to automate workflows, including outgoing email. When delivering automated emails, Ava will send email over a transport layer security (TLS) encrypted channel whenever possible; however, if the receiving email server does not support TLS, automated emails will send in cleartext.
- Refrain from including ePHI directly in the body or subject line of the email. Ava cannot guarantee that the email content will be encrypted if the receiving email server does not support TLS.
- Be mindful of recipients when configuring automated messages.

How Ava Supports HIPAA Compliance

The following table demonstrates how Ava supports our customers’ efforts to meet HIPAA Security and Privacy Rules.

HIPAA Standard	Ava Functionality
Implement technical policies and procedures for electronic information systems that maintain electronic protected health information to allow access only to those persons or software programs that have been granted access rights. [164.312 (a) (1)]	Password and domain-restricted shares: Restrict your conversations by password or email domain. Transcript editing permissions: Limit who can edit words in a transcript. Granular interface permissions: Control who can access conversations by sharing your Ava Room captions without sharing the underlying room access. User rights: Create and manage rights for users.
Assign a unique name and/or number for identifying and tracking user identity. [164.312 (a) (2) (i)] Implement electronic procedures that terminate an electronic session after a predetermined time of inactivity. [164.312 (a) (2) (iii)]	SAML-based single sign on (SSO): Give organization members access to Ava through an identity provider (IdP) of your choice. We work with providers including Google, Okta, Microsoft Azure, OneLogin, and more. SCIM user provisioning: Provision and deprovision users centrally via SCIM from Okta, Microsoft AD, and other providers. SCIM-synced user groups: Add and remove users from user groups centrally via SCIM from Okta and Microsoft AD. For more information on SSO and SCIM, please contact us.
Implement a mechanism to encrypt and decrypt electronic protected health information. [164.312 (a) (2) (iv)]	Enterprise Key Management (EKM): Get additional control over the data you store in Ava and visibility into how it’s accessed using your own encryption keys. Available as an add-on for Ava Enterprise customers. For additional information on EKM, please contact us. Data transmitted between customers and Ava’s service is encrypted using industry standards TLS 1.2 or higher. Data at rest is encrypted using industry standard AES 256-bit encryption within Ava’s systems.
Implement hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use electronic protected health information. [164.312 (b)]	Enterprise Org Space: Get central visibility and control over your organization’s users and conversations with Ava’s full admin experience, standardized security policies, tiered admin roles, and more. For additional information on the Enterprise Org Space, please see here. Enterprise audit logs: Ava Enterprise’s audit logs allow admins to monitor activity within their organizations. Audit logs are accessible through your reports' page in admin panel or programmatically through Ava’s API. For additional information on Audit Logs, please see here. Admin reports: See information about share links, workspaces, bases, users, user activity, and more.
Implement policies and procedures to protect electronic protected health information from improper alteration or destruction. [164.312 (c) (1)] Establish (and implement as needed) procedures for obtaining necessary electronic protected health information during an emergency. [164.312 (a) (2) (ii)]	Ava maintains high availability through multiple availability zones, cross-region replication, and backups.
Implement technical security measures to guard against unauthorized access to electronic protected health information that is being transmitted over an electronic communications network. [164.312 (e) (1)]	Domain management: Verify and manage your organization’s domains through DNS by request to our support.
Implement policies and procedures to address the final disposition of electronic protected health information, and the hardware or electronic media on which it is stored. [164.310 (d) (2) (i)]	Custom retention policies: Create policies to manage retention timeframes and protect data by deleting inactive bases in your organization. For additional information on retention policies, please contact us. Ava maintains data backups and a revision history subject to the chosen plan. For additional information on Ava plan tiers, please contact us.

Security, Privacy, and Compliance at Ava

Protecting customer data is core to Ava. We take privacy and security into consideration in all aspects of the platform and supporting infrastructure and are committed to meeting global security and privacy requirements. For additional information, please visit our Security Center