ChironAI™ OM · trust & security

AI that discloses itself. Access you can account for.

Every AI output carries a deterministic AB 3030 / AB 489 disclosure, and any licensure-implying phrasing is rewritten before you see it.

In place today

What protects the record.

AI that discloses itself and never claims a licence

Every AI output carries a deterministic AB 3030 / AB 489 disclosure, and any licensure-implying phrasing is rewritten before you see it.

A server-built AI-use disclosure, citing AB 3030 and AB 489, is attached to every AI response — not left to a prompt.
First-person licensure phrasing (“I diagnose”, “my medical license”) is rewritten to the decision-support register.
Untrusted document text is sanitised for prompt injection before it reaches the reasoning layer.

Access you can account for

MFA, per-case access grants, a searchable log of every PHI read and write, and alerts on unusual access.

TOTP multi-factor authentication, with an administrator able to require it clinic-wide.
The primary treating physician grants and revokes access to each case.
Every PHI read and write is logged and searchable by user, patient, case and action.
Every five minutes, bursts of failed sign-ins and mass PHI reads raise alerts to clinic administrators.
A clinic’s full data, files included, can be exported for a records request or on offboarding.
Single sign-on with your identity provider is being built; today sign-in is password plus TOTP MFA. Coming

Chiron recommends. You adopt, edit or disagree.

For causation, apportionment, MMI and work restrictions, Chiron proposes an opinion with its reasoning — and only your decision becomes the recorded opinion.

Chiron recommends a causation, apportionment, MMI or work-restriction opinion, verified by a separate pass; the physician adopts, edits or disagrees.
A server-side guard, in two independent layers, lets the causation-opinion section draft only from the physician’s own decision or a finalized analysis — never from an unreviewed AI analysis.

Straight answers

The questions procurement asks.

How is one clinic’s data kept from another’s?: Row-level security on a shared database: every query is scoped to the clinic, enforced by the database itself. It is not a separate database per clinic.
Do you hold SOC 2 or HITRUST?: No. We do not hold either certification today, and we will not imply otherwise. Ask for our security pack for the controls we do run.
Single sign-on?: Being built. Today sign-in is password plus TOTP multi-factor authentication, which an administrator can require clinic-wide.
E-signature?: Physicians sign inside OM with their own signature, an attestation statement and a cryptographic hash of the signed document. There is no third-party e-signature service.
Does the AI decide anything?: No. Chiron reads, drafts and proposes. A licensed physician reviews, decides and signs, only the physician’s own decision becomes the recorded opinion, and only a physician can attest a report.
Does OM send claims to payers?: No. OM builds the 837P claim file; your billing partner transmits it.

Company-wide controls, data handling and subprocessors: the ChironAI Trust Center.

Bring your security questionnaire.

A live demo on a synthetic case — panel, records, report, billing. The AI reasons. The clinician decides.

Book a demo

AI that discloses itself and never claims a licence

Access you can account for

Chiron recommends. You adopt, edit or disagree.

Bring your security questionnaire.

See it run an encounter that looks like yours.