mediloop
Discuss a partnership
Security and data

Their bills stay theirs. You get the reporting.

Each employee or member shares their documents with mediloop directly and authorizes their own case. The organization gets agreed aggregate reporting, never individual bills.

Encrypted at rest and in transitNo AI training on documentsAggregate reporting only
The data flow

Who sees what, step by step.

01

The person shares

The employee or member uploads their own bill, EOB and documents to mediloop. The organization doesn't collect, forward or see them.

Person to mediloop
02

The person authorizes

Before mediloop contacts a provider or insurer, the person signs a HIPAA authorization for their own case.

Authorization per case
03

The organization gets totals

Reporting is aggregate: use, cases worked and how they resolved. Anything more detailed has to be agreed in writing and authorized.

Aggregate only
How data is protected

What we do with the documents.

Health related data encrypted at rest with AES-256
Data encrypted in transit with TLS
Documents read by an AI service only to work the person's case
Bills and documents never used to train any AI model
Personal and medical data never sold to data brokers
A human advocate on every case, and the only one who contacts providers or insurers
Health information handled in line with HIPAA, as set out in our terms
Contact with a provider only under the person's own HIPAA authorization

The full detail is in our privacy policy and terms of service. Security questionnaires, data processing terms and any BAA are handled during scoping.

HIPAA and your plan

Why HR doesn't need to see anyone's bill.

Under HIPAA, a group health plan can give the employer, as plan sponsor, summary health information and enrollment information. Sharing other protected health information needs plan document changes and a certification from the employer. mediloop's reporting is built so none of that is needed.

Whether a BAA is needed depends on the setup. A vendor that handles protected health information for a health plan, for example claims or billing work, is generally a business associate. A service the person uses directly, on their own authorization, may sit outside that. We go through the data flow with your counsel during scoping rather than making a blanket promise.

Sources

The HIPAA rules referenced

  1. eCFR, 45 CFR 164.504(f), group health plan disclosures to the plan sponsor, US Government Publishing Office, Electronic Code of Federal Regulations
  2. HHS, Business associates, US Department of Health and Human Services
  3. HHS Office for Civil Rights, Your medical records, US Department of Health and Human Services, Office for Civil Rights
Questions security teams ask

Security and data, answered.

mediloop handles personal and health information in line with HIPAA and applicable California medical privacy laws, as set out in its terms of service, and contacts providers only under the person's own HIPAA authorization. Whether a business associate agreement is needed depends on how a partnership's data flows, and is confirmed during scoping.
No. Employees share their documents with mediloop directly. The employer receives agreed aggregate reporting about use and outcomes, and individual case details are not routinely shared.
Yes, to read the documents and check the charges for that person's case. Documents are never used to train any AI model, mediloop's or anyone else's. A human advocate reviews every case.
Health related data is encrypted at rest using AES-256 and in transit using TLS.
Not always. A pilot can run on direct intake. If eligibility needs checking, the method and the data involved are agreed during scoping.

Privacy policy · Terms of service · For organizations · Vendor checklist

Last reviewed

Agent Loop, the mediloop fox mascot, striking a superhero pose

Bring your security questions to the first call.

Tell us about your organization and what your security, legal or procurement review needs. We'll come back to you with answers before anything is set up.

Prefer email? sales@mediloop.ai