EchoReview AI
RESEARCH PREVIEW — NOT FOR CLINICAL USE. EchoReview AI is an investigational workflow tool. Output is a preliminary, non-diagnostic impression intended to support cardiologist review for research and quality-improvement purposes only. Not FDA-cleared. Do not use for patient care decisions. Do not upload identified PHI without an executed BAA.

We are ready to sign a Business Associate Agreement

EchoReview AI will execute a HIPAA BAA with any qualified hospital or research institution before handling Protected Health Information. A draft template is available for review by hospital counsel.

Review BAA templateLearn about de-identified uploads
Compliance posture summary

HIPAA & compliance readiness

What we have built for safe research use today, and the remaining checklist before a rural-hospital pilot.

Implemented & active
Planned / in progress
External dependency

Implemented controls

Live in production today

  • Audit logs
    Done

    Every view, upload, sign-off, and addendum is timestamped with user ID, IP address, and user agent. Immutable append-only table with study-scoped and org-scoped queries.

  • Role-based access control (RBAC)
    Done

    Three clinical roles: technician (upload / view), cardiologist (sign / addendum), and admin (member management). Enforced in both UI and database RLS policies.

  • Organization isolation
    Done

    Multi-tenant architecture. Each hospital or research group is a separate organization. Data is fully walled off by org_id in every table with Row-Level Security.

  • Two-factor authentication (TOTP)
    Done

    Users can enroll Google Authenticator, 1Password, Authy, or any RFC-6238 TOTP app. 2FA is strongly recommended for all clinical accounts.

  • Idle session timeout
    Done

    Automatic sign-out after 15 minutes of inactivity. Resets on mouse, keyboard, touch, or scroll events.

  • Failed-login lockout
    Done

    5 failed password attempts trigger a 15-minute account lockout per email address, reducing brute-force risk.

  • Password re-authentication for sign-off
    Done

    Before a cardiologist finalizes a diagnosis, the platform requires the user's password again — a 21 CFR Part 11–style electronic signature checkpoint.

  • Signed-study immutability + addendums
    Done

    Once a study is signed, core fields are locked. Corrections are made via addendums that create a new audit row, preserving the original interpretation trail.

  • Database RLS & encrypted storage
    Done

    Supabase Row-Level Security policies enforce org-scoped access at the database layer. Storage buckets use TLS in transit and AES-256 at rest.

  • Invitation-only membership
    Done

    New org members join via time-limited, tokenized email invitations. No open enrollment. Owners and admins control roster and role assignment.

Remaining for pilot

Needed before a rural-hospital clinical pilot

  • Business Associate Agreement (BAA)
    External

    A signed BAA between EchoReview AI and each hospital is required under HIPAA when handling PHI. This is a legal/contractual step, not a technical one.

  • Formal HIPAA Security Rule gap analysis
    In progress

    A documented risk assessment covering administrative, physical, and technical safeguards — including unique-user IDs, emergency access, and automatic logoff.

  • FDA 510(k) clearance or CDS exemption
    External

    To market as a diagnostic support tool, the AI module likely needs FDA 510(k) clearance or validation as a Clinical Decision Support (CDS) feature under the 21st Century Cures Act.

  • SOC 2 Type II audit
    In progress

    Independent attestation of security, availability, and confidentiality controls over a 6–12 month observation period. Expected timeline: 3–6 months to achieve.

  • Third-party penetration test
    In progress

    Hire a qualified firm to perform annual network, application, and social-engineering penetration testing with a remediation report.

  • Staff training & competency records
    In progress

    Documented training for all users on PHI handling, password hygiene, incident reporting, and the difference between AI output and a final cardiologist interpretation.

  • Data retention & deletion policy
    In progress

    Formal policy defining how long echo images and audit logs are kept, how de-identified research datasets are handled, and the secure-deletion procedure upon patient or hospital request.

  • Backup & disaster recovery testing
    In progress

    Documented Recovery Point Objective (RPO) and Recovery Time Objective (RTO), with quarterly restoration drills.

  • Incident response & breach notification plan
    In progress

    Written runbook for detecting, containing, and reporting breaches to affected hospitals and HHS within the required 60-day HIPAA window.

  • Physical safeguards (if on-premise)
    In progress

    If any component runs inside the hospital (e.g. a local DICOM bridge), document workstation security, access badges, and video surveillance.

Encryption & access controls

How we protect echo images and patient data from the moment they arrive to long-term storage.

Data-at-rest

Echo images, audit logs, and database backups are encrypted at rest using AES-256. Encryption keys are managed by the cloud infrastructure provider, rotated automatically, and never exposed to application code.

Data-in-transit

Every browser connection, API request, and storage transfer is protected by TLS 1.3. Weak cipher suites and deprecated protocols (SSLv3, TLS 1.0/1.1) are disabled at the edge. Certificate pinning is handled by the platform.

Access control & audit

Row-Level Security policies enforce organization-scoped access at the database layer. Every view, upload, and sign-off is logged with user ID, timestamp, IP address, and user agent in an immutable audit trail.

Interested in a pilot?

We are looking for 2–3 rural or Critical Access Hospitals to run a 90-day quality-improvement pilot. All data stays in your isolated organization workspace. A BAA and IRB approval are prerequisites.

Request pilot accessEmail compliance team