Is Ambrose HIPAA compliant?

Yes, as a platform rather than as a setting you switch on. Client data lives in an encrypted vault scoped to your agency, every read and write is isolated to that agency, PHI only runs against model providers under a signed BAA, and every action is logged and approvable.

Where does client data go when an agent runs?

To a model provider covered by a signed Business Associate Agreement, which in practice is Claude through Amazon Bedrock in US regions. Your vault files stay in your agency vault.

Can one agency see another agency’s data?

No. The acting agency id comes from the server session, never from chat input, and Postgres row level security enforces it beneath the application filters.

How client data is protected

Encrypted agency vault

Your book of business lives in a vault scoped to your agency: HealthSherpa exports, commission reports, carrier documents, call recordings and transcripts. Files are encrypted at rest and indexed so your agents can query them in plain English. They are never pooled with another agency's data.

Per agency isolation

Every read and write carries the acting agency id, resolved from the session on the server and never from user or model input. The application filters on it and Postgres row level security enforces it underneath, so a prompt cannot talk its way into another agency's rows.

BAA covered model routing

Protected health information (PHI: the details HIPAA protects, like a client's name, date of birth, and plan) only runs against model providers covered by a signed Business Associate Agreement. In practice that is Claude through Amazon Bedrock, in US regions. See AWS Bedrock.

Audit trail and approval gate

Every model call is logged with model, provider, tokens, cost, and latency, and every action an agent takes is recorded. Anything that writes back to your CRM waits for your approval with Allow, Deny, or Always Allow until you decide to let a specific action run unattended. See Data flow.