Last updated: May 1, 2026(version 2026-05-01)
For our live compliance posture, sub-processor list, certifications, and security controls, visit our Trust Center .
UM-AI (operated by SSP Development LLC) functions as a Business Associate under HIPAA whenever it processes Protected Health Information (PHI) on behalf of Covered Entities — including health plans, hospitals, and physician practices. In that capacity, UM-AI is bound by the HIPAA Privacy Rule (45 CFR Part 164 Subpart E), Security Rule (45 CFR Part 164 Subpart C), and Breach Notification Rule (45 CFR Part 164 Subpart D).
Business Associate Agreements (BAAs) are required before any Covered Entity may transmit PHI to UM-AI. A standard BAA template is available at umgpt.ai/baa. Custom BAAs can be requested via privacy@umgpt.ai.
UM-AI limits PHI access to the minimum necessary to fulfill the utilization management purpose. Clinical input submitted for AI evaluation is processed in memory to generate results and is not stored in identifiable form beyond what is required for audit-log integrity under HIPAA §164.316(b)(2)(i).
Workforce Access Management
Access to systems containing PHI is granted on a role-based, need-to-know basis. Workforce members complete HIPAA-awareness training before receiving system access. Access rights are reviewed quarterly and revoked immediately upon separation.
Security Awareness Training
All personnel with access to PHI or PHI-adjacent systems complete annual HIPAA security training. Training completion is tracked and evidence is maintained in the Vanta compliance program.
Security Incident Procedures
UM-AI maintains written security incident and breach response procedures (see Breach Notification section below). Incidents are logged, triaged, and escalated per the Incident Response Plan reviewed annually.
Contingency Plan
UM-AI's contingency plan documents recovery procedures for system failures. Data backup is managed by Neon's automated point-in-time recovery (PITR) system, which retains database snapshots for the contractually agreed retention window. Recovery Time Objective (RTO) and Recovery Point Objective (RPO) targets are tested annually.
Hosted Infrastructure
UM-AI is hosted entirely on cloud infrastructure provided by Replit, Inc. (compute) and Neon, Inc. (database). Both providers maintain SOC 2 Type 2 attestations and operate from physical data centers with access controls including badge authentication, CCTV surveillance, and security staffing. Physical facility access is managed entirely by these providers and covered by their respective HIPAA BAAs with UM-AI.
Workstation Security
Personnel accessing PHI or administrative systems do so on encrypted, screen-locked workstations. Full-disk encryption is required on all workstations. Workforce members are prohibited from accessing PHI on unmanaged or public devices.
Media Controls
No PHI is stored on removable media. Database exports containing PHI require written approval and are encrypted at the file level. All data is retained and disposed of in accordance with the HIPAA retention requirements and our data retention policy.
Access Controls — RBAC + MFA
Each user is assigned exactly one role (User, Manager, UMdirector, or Super Admin) with the minimum permissions required for their function. Multi-factor authentication is enforced for EHR-integrated users via the VIM Canvas SDK identity provider. Direct-login MFA enforcement is tracked in the Vanta roadmap.
Audit Controls
All authentication events, authorization decisions, evaluation submissions, and administrative actions are written to an immutable audit log retained for a minimum of six years per HIPAA §164.316(b)(2)(i). Log entries contain no raw PHI — clinical fields are reduced to structured metadata (specialty, urgency, decision outcome) before being written.
Integrity Controls
Database integrity is protected by Neon's WAL-based replication and point-in-time recovery. SHA-256 checksums are applied to compliance evidence artifacts. Application logic prevents data modification by unauthorized roles at the API layer.
Transmission Security — TLS 1.3
All data in transit between clients and the UM-AI platform is encrypted using TLS 1.3. HTTP traffic is redirected to HTTPS automatically. TLS 1.0 and 1.1 are disabled. All sub-processor communications (Neon, OpenAI, Stripe) are also encrypted in transit.
UM-AI maintains a written Breach Notification procedure consistent with the HIPAA Breach Notification Rule. A breach is defined as any acquisition, access, use, or disclosure of PHI that is not permitted by the Privacy Rule and poses a significant risk of financial, reputational, or other harm to the individual.
72-Hour Notification to Covered Entities
Upon discovery of a confirmed breach, UM-AI will notify the affected Covered Entity within 72 hours, consistent with our BAA obligations and 45 CFR §164.410. Notification will include: date of breach discovery, PHI categories involved, estimated number of individuals affected, corrective actions taken, and recommended steps for the Covered Entity.
Internal Escalation
Security incidents are routed to the Security Officer within 1 hour of detection. Breach risk assessment is completed within 24 hours. The Covered Entity is notified within 72 hours. HHS notification for breaches affecting ≥500 individuals is filed within 60 days per 45 CFR §164.408.
Contacts