HIPAA & Security Architecture
Why a dedicated private VPS isn't just a marketing claim — it's a genuine legal and technical moat that no shared-cloud AI tool can replicate.
The Problem With Every Other AI Tool
Every major AI tool in the healthcare/practice space — from AI chatbots to scheduling assistants to CRM automations — shares one fundamental architecture flaw: your patient data lives on their servers.
When you use a SaaS AI tool, your patient names, phone numbers, appointment times, and communications flow through their infrastructure. Their engineers could theoretically access it. Their security team is responsible for protecting it. Their breach is your breach — and your patients' breach.
Under HIPAA, this makes them a Business Associate — an entity that creates, receives, maintains, or transmits PHI on your behalf. Not every vendor acknowledges this. Not every vendor will sign a BAA. And even when they do, they still have your data.
How ClinicClaw is Built Differently
Architecture Overview
The key insight: ClinicClaw is not a SaaS platform. It's a managed deployment of software on your infrastructure. We configure it, we maintain it, we support it — but the server is yours and the data is yours. We never have custody of your patient information.
HIPAA Technical Safeguards
HIPAA's Security Rule (45 CFR § 164.312) requires covered entities and business associates to implement technical safeguards for electronic PHI. Here's how ClinicClaw meets each requirement.
Access Control (§ 164.312(a))
Unique user IDs and automatic logoff required for systems containing ePHI.
Each ClinicClaw deployment has unique API keys and session tokens. Agent access is role-scoped. There is no shared credential pool.
Audit Controls (§ 164.312(b))
Hardware, software, and procedural mechanisms to record and examine system activity.
OpenClaw maintains a full, time-stamped activity log of every action taken — every message sent, every API call made, every data access. Logs are stored on your server and exportable.
Integrity (§ 164.312(c))
Mechanisms to authenticate ePHI and prevent unauthorized alteration.
All communications are signed and verified. Data at rest is checksummed. Any tampering with stored records is detectable.
Transmission Security (§ 164.312(e))
Technical security measures to guard against unauthorized access during transmission.
All communications use TLS 1.3. Webhook endpoints are authenticated with secret tokens. No ePHI is transmitted in plaintext.
PHI Minimization by Design
The most powerful privacy protection is to not handle PHI in the first place. ClinicClaw is designed to operate on the minimum PHI necessary to do its job.
What ClinicClaw Handles
- •Patient name (first name for personalization)
- •Phone number (for SMS communication)
- •Appointment date and time
- •Service type (e.g. chiropractic adjustment)
- •Confirmation status (confirmed / not confirmed)
What ClinicClaw Never Touches
- •Clinical notes or diagnoses
- •Treatment history or medication records
- •Insurance information or billing records
- •Social Security Numbers or government IDs
- •Lab results or imaging reports
Business Associate Agreements
Under HIPAA, any third party that handles PHI on your behalf must be under a signed Business Associate Agreement. Here's the full BAA chain for a ClinicClaw deployment.
ClinicClaw / Metaphase Marketing
Yes — included in Operate and Scale plans
Manages deployment, maintenance, and configuration of your ClinicClaw agent
Anthropic (Claude AI)
Yes — available via Anthropic's HIPAA program
Processes text prompts for AI reasoning; receives zero PHI by architecture
Twilio (SMS)
Yes — Twilio's BAA is available for all customers
Transmits appointment reminder and follow-up text messages
Hostinger (VPS provider)
Not required — they provide compute only; they cannot see your data
Provides the physical/virtual server hardware. Encrypted data at rest means they see only ciphertext.
Why Local-First Is a Genuine Moat
Cloud-based AI tools cannot replicate what ClinicClaw offers by architecture. To match us, a SaaS competitor would have to:
- 1.Stop storing customer data on their shared infrastructure (destroying their existing business model)
- 2.Deploy isolated instances per customer (dramatically increasing operational complexity and cost)
- 3.Give customers actual ownership of the server (eliminating their own access to the data)
- 4.Rebuild their entire data layer, analytics, and operations model
This is not a feature they can ship in a sprint. It's a complete architectural rewrite that invalidates their unit economics. This is our moat, and it gets stronger as AI becomes more embedded in clinical workflows.
Legal disclaimer: This page describes ClinicClaw's technical architecture and general approach to HIPAA compliance. It does not constitute legal advice. Whether any specific deployment is HIPAA-compliant depends on your practice's unique configuration, workflows, and the applicable HIPAA Privacy and Security Rules. We strongly recommend consulting with a qualified healthcare attorney or compliance officer to assess your specific situation. ClinicClaw is designed to support HIPAA compliance, not guarantee it.
Ready for AI that actually respects your patients' data?
Limited spots available. We review every application individually.
Apply for ClinicClaw→No credit card required to apply.