Trust, security and compliance
Built to pass your security review before the first meeting.
Atticus is an accredited, HIPAA covered care provider. Member data is treated that way from the first roster to the last report.
Where we stand
Accredited now. Audited as we grow.
Every status below is current. This page changes the day a review closes.
URAC Case Management 7.0
An outside review of how Atticus runs care management, from outreach to transitions of care.
AccreditedURAC AI in Healthcare 1.0
Accredited as both developer and user of AI. It covers how models are built, monitored and governed.
AccreditedHIPAA covered entity
Atticus is a Type 2 NPI provider. It holds member data as a covered entity, with a covered entity's duties.
In placeTEFCA through Kno2
Approved to exchange records on the national framework through a qualified network, Kno2.
ApprovedSOC 2
An independent audit of our security controls is underway. The report joins the packet the day it is issued.
Audit underwayHITRUST
Certification follows SOC 2.
Planned nextHow data is handled
Your members' data, locked down and logged.
Built on AWS. Every safeguard below runs for every organization from day one.
Encrypted
Member data is encrypted at rest and in transit. PHI lives in one encrypted store.
Logged
Every access to member data is recorded. You can see who opened what, and when.
Sealed
Every action goes into an append-only audit log. It is sealed the day it happens and checked daily. Nobody can rewrite it.
Walled off
Each organization's members and reports are kept apart from every other organization's.
Minimum necessary
Searches that leave Atticus carry no name, member ID or birth date.
Yours
You own your data. Take a full export anytime, at no cost.
AI that answers to the care plan.
Atticus works only inside physician-written care plans. It takes orders from the plan and the care team alone. No web page or email can give it instructions.
Never trained
Member data is never used to train a model
✓ Confirmed
PHI stays under a BAA
Models run on AWS, under a business associate agreement
✓ Under a BAA
Checked twice
A second model checks every draft before a member sees it
✓ Sources attached
Emergencies first
Fixed 911 and 988 replies go out before any model writes
✓ Always on
Always says AI
Members always know it is AI, and a person can step in
✓ Clinicians decide
How we hold data
Two HIPAA roles, named plainly.
You should know what runs today, and under which role.
Covered provider
For care under its own NPI, Atticus is a HIPAA covered health care provider. That includes electronic eligibility transactions.
Business associate
For delegated work for health plans and other customers, Atticus acts as a HIPAA business associate.
Contracts before data
BAAs are signed with AWS and OpenAI. Clinical text runs on AWS Bedrock. Every other partner signs before any data moves.
AI and state law
One standard for every state: the strictest one.
Between 2025 and 2026, about two dozen states wrote laws about AI that talks to people about their health. Atticus builds to the strictest requirement in each category and applies it to every member, wherever they live. Read the crisis protocol.
Tell members they are talking to software
Active
Two lines open every conversation: these are care bots, not a substitute for clinical care. They answer plainly when asked.
Never imply a license, a clinician or clinical confidentiality
Active
No protected title appears in member-facing text. A build check fails if anyone adds one.
Do not diagnose or treat
Active by design
The AI explains a member's own information and runs the care plan a clinician set. It never diagnoses.
Clinicians oversee how the AI behaves
Accredited
Clinicians govern its protocols, limits and design. URAC reviewed them under AI in Healthcare 1.0.
Detect a crisis and refer
Active
Every message is checked before it is stored or read by a model. A positive result puts 988 on screen and alerts a person. Any error escalates.
Publish the crisis protocol
Active
Published in full, with how detection works and last year's referral count.
Do more than refer once
Active
A crisis schedules its own follow-up. A member who keeps expressing risk gets a person.
Never send a crisis to law enforcement
Active
Referrals go to a crisis service, in every state.
Do not use AI to detect emotions
Aligned
The safety check looks for specific phrases and opens a referral. It makes no mood score and no finding about mental state.
Consent before recording
Active
Voice sessions need consent on file and open by saying the call is recorded. Recordings never train a model.
No vendor sees member words without a contract
Active
BAAs are signed with AWS and OpenAI. Clinical text runs on AWS Bedrock. A build check blocks any model vendor without a BAA.
Detect eating-disorder and financial-harm language
Active
Both are detected and go to a person, without opening a crisis screen.
File a written AI policy with Utah
In progress
The policy is written. The filing is in progress.
Report crisis referrals to states
Scheduled
State filings begin July 1, 2027. Every referral already writes an audit record.
Illinois and Vermont bar AI from detecting a mental state. Other states require detecting expressions of suicidal ideation. Our safety check produces a referral, not a finding about a person. Counsel is reviewing that reading.
People and partners
No one touches member data without signing first.
The member stays in control, and every partner is held to the same rules Atticus is. See the partners Atticus works with.
Business associate agreements
Every partner signs a BAA before any data moves.
Consent by channel
Members consent channel by channel and can change their minds anytime.
Family by invitation
The member chooses who helps and what each person sees.
Clinicians decide
The AI never diagnoses, prescribes, changes a dose or denies care.
The security packet
Your whole review, answered in one send.
Shared under NDA. Email security@atticushealth.com and we will send it the same week.
Your questionnaire, completed
Send your security questionnaire and get it back filled in. Or start from our standard answers.
Policies and accreditations
Security, privacy and incident response policies, plus our URAC certificates.
BAA and SOC 2
Our business associate agreement, and the SOC 2 report the day it is issued.
Report a concern
Found something? Tell us first.
If you believe you have found a security issue, email security@atticushealth.com. We confirm receipt and keep you posted until it is resolved.
Send us your questionnaire, and we'll send it back complete.
Reviews close faster when your security team has the packet before the first call.
