Policies, training & access
Controls for who can access systems and how staff handle PHI.
- Least-privilege access
- Documented security policies
- Workforce training
Security at Kubo
Kubo protects PHI with HIPAA-aligned safeguards, a BAA with every practice, encryption in transit and at rest, and US-based hosting.
HIPAA by design
Kubo is designed around the administrative, physical, and technical safeguards defined by the HIPAA Security Rule.
Controls for who can access systems and how staff handle PHI.
PHI is hosted in US-based cloud infrastructure with managed physical security.
Software controls protect PHI and record access.
A BAA is signed with every practice before PHI is exchanged.
Infrastructure
PHI is encrypted from capture through storage, and hosted in the USA.
Every connection between the app, our services, and your PMS is encrypted in transit.
Stored PHI is encrypted at rest with AES-256.
Data is hosted with a major US cloud provider in US regions.
Access & audit
Each account gets only the access its role requires. Sign-in is protected with SSO and MFA, and every action on the record is logged.
Role-based access
Only a clinician can sign & finalize a record.
Sign-in & controls
Retention & ownership
You control how long Kubo retains data and can request deletion at any time. Your PMS remains the system of record.
See how PHI and AI are handledSet retention periods by account to match your practice and state requirements.
Request deletion at any time. Once a note is signed and synced, your PMS holds the record.
Audio is transcribed and discarded, not stored for playback.
The questions we hear most, answered plainly.
Yes. Kubo follows the administrative, physical, and technical safeguards of the HIPAA Security Rule, and we sign a Business Associate Agreement with every practice before any PHI is exchanged. DSOs can review and tailor BAA terms with their compliance team.
PHI is encrypted in transit with TLS 1.2 or higher and at rest with AES-256. This covers transcripts, notes, documents, and data synced to your PMS.
Kubo is hosted with a major US cloud provider in US-based regions, with data isolated per practice.
Access is role-based. Assistants capture and prepare drafts, clinicians review and sign, and administrators manage users and locations. Sign-in supports Microsoft SSO and multi-factor authentication, and every action is recorded in an audit log.
Retention is configurable to match your practice and state requirements, and you can request deletion at any time. Once a note is signed and written back, your PMS is the system of record. Audio is discarded after transcription. See the Safety page for the full data lifecycle.
Yes. DSOs and groups can sign a custom Enterprise License Agreement with tailored BAA terms covering every location, with centralized administration and per-location access controls.
Walk through Kubo’s safeguards with our team, or send us your security questionnaire and BAA.