Security & HIPAA

Last updated: July 23, 2026

Our commitment

Orion AI is built for HIPAA-compliant practices, with security considered from day one.

HIPAA and your BAA

We sign a Business Associate Agreement with practices that handle protected health information. The BAA sets out our obligations for safeguarding PHI.

Encryption

Data is encrypted in transit, and at rest where applicable, using industry-standard methods.

Access controls

Access to data is restricted on a need-to-know basis. For multi-location groups, each person’s access is scoped to the locations they actually work at.

Local-first option

For practices that need patient data to stay inside their own network, Orion can run locally on a machine in your office.

Infrastructure and monitoring

The service runs on reputable cloud infrastructure with logging and monitoring designed to detect and respond to issues.

Incident response

We maintain a process to investigate and respond to security incidents and to notify affected practices as required.

Report a vulnerability

Found a security issue? See our security.txt or email get@orionths.com.

Contact

Questions about security or HIPAA? Reach us at our contact page.