Security, privacy, evidence and claims
Built for healthcare content from the start.
HealthLiteracyCopilot is a HealthcareGPS product. HealthcareGPS is SOC 2 Type II audited and HIPAA compliant. HealthLiteracyCopilot is covered by that audit.
Each organization works in its own private workspace. People see only what their role allows. Every change keeps a record of who approved it.
- SOC 2 Type IIAudited
- HIPAACompliant
- EncryptedIn transit and at rest
Security documents include our security overview, the SOC 2 Type II report under NDA, BAA terms, our AI data policy and access controls. See what's included
Security documents for your review
For your security, privacy and procurement reviewers. Ask through the contact form and we send what your review needs.
Security overview
Architecture, tenant isolation, encryption, data flow and AI subprocessors.
SOC 2 Type II report
The HealthcareGPS audit report, shared under NDA.
BAA terms
The business associate agreement template for eligible customers.
AI data policy
What is sent to AI models, identifier controls and AI-use disclosure.
Access and audit
SSO, SCIM, roles and a sample audit-trail export.
Your questionnaire
Send us your security questionnaire and we answer it.
How to get them
AskTell us what your review needs through the contact form.
ConfirmWe confirm the documents and send an NDA for the SOC 2 report.
ReceiveWe send the documents and answer your questionnaire.
From draft to evidence
Step 1: Draft
Upload or create in your private workspace
Step 2: Check
Meaning check and clinical integrity check on every change
Step 3: Approve
A named reviewer approves; export uses approved changes only
Step 4: Lock
The approved version is hash-pinned and frozen
Step 5: Record
Append-only audit trail of access and AI use; CSV export
Step 6: Evidence
Binders as PDF or ZIP for reviewers and surveyors
In their words
What reviewers noticed
…sent exactly what you sent us to our privacy legal team for review and approval and they had no notes. … the tool knocked it out of the park on the first try.
Director of communications, regional health plan I expected there to be some maybe inherent biases in an automation tool like this, an AI tool. … we did not see that. And in fact, it removed biases … when it was existing in the original content.
Director of patient education, multi-hospital health system
From people using HealthLiteracyCopilot, shared anonymously by role and type of organization. Trimmed where marked (…), never reworded.
Checks that run on every change
Meaning check
Flags a rewrite that changes what the sentence says.
Clinical integrity check
Flags a changed dose, frequency, route or device. It also flags a lost "do not", a lost urgent step or steps out of order.
Additions labeled
Anything the AI adds is marked ADDITION and needs approval.
Numbers to verify
Every dose, date and dollar amount is listed for a person to check.
Translation safety
A segment that could lose a dose or a "do not" goes to a human translator.
Access and data controls
- Single sign-on with SAML or OIDC, and SCIM user provisioning.
- Owner, admin and custom roles, by department.
- An organization policy for identifiers sent to AI: allow, redact or block.
- Members-only knowledge-base documents and confidential projects, enforced through exports.
- Support access is attributed and recorded in the audit trail.
- Your content is encrypted in transit and at rest.
- Your organization owns its documents and results. We use them only to provide the service.
- Your documents and results are stored in the United States.
A business associate agreement is available for eligible customers. Ask for BAA terms with the security documents.
Common security questions
Is it safe to put our documents into AI?
Start with templates that hold no personal details. The free review accepts only those. In the product, your policy decides whether identifiers are allowed, removed or blocked before anything reaches the AI models.
Proof: HealthcareGPS is SOC 2 Type II audited and HIPAA compliant. Each organization has its own private workspace, and access and AI use are recorded.
What does IT need to do?
Very little. It runs in the browser, with nothing to install. You can add single sign-on and automatic user setup. Documents go in and out as Word, PDF or HTML, so no system integration is needed to start.
Proof: Our security documents, with the security overview and data flow.
How we talk about results
Lead with the lever you own. Prove your contribution. Never promise the outcome.
We control the clarity of your content. Health outcomes depend on many things we do not control. So we measure what we change, help you measure what follows, and never promise the result.
Readability formulas answer only L1. HealthLiteracyCopilot works on L1–L2, tests at L3–L4, and helps you measure your own results at L5–L6.
| We say | We qualify | We don't say |
|---|---|---|
| Built on IHA's N-PLAT and AHRQ's PEMAT | Outcome results come from your own baseline and are labeled as pilot results | Guaranteed outcomes or savings |
| Improves readability and understandability scores | Clear communication "contributes to" outcomes | A percent lift without your own study |
| Supports CMS, Section 1557 and Joint Commission plain-language requirements | Comparisons only with a substantiation file | "Ensures compliance" or "certified" |
| Improves the communication that drives outcomes | Simulated-reader results are directional | "HIPAA certified", "ADA compliant", "accreditation-ready" |