Least-privilege access
Server-enforced roles, assignment visibility, and narrow integration scopes limit who can see or act on each record.
Security and governance
Healthcare AI controls that live inside the workflow.
MyAIPOS is designed around minimum-necessary access, human accountability, source provenance, and explicit evidence boundaries. It does not claim a certification or replace a practice’s legal compliance program.
Practice and personal separation
Practice and personal Mailroom data use separate storage, audit, onboarding, and management paths.
Human-review gates
AI output remains a draft. Reviewers compare source evidence, edit, approve, or reject before governed work advances.
Immutable evidence
Important configuration and review decisions create bounded audit events without copying full message or attachment content.
Minimum-necessary views
Sensitive message content is retrieved on demand, sanitized, rendered without active content, and not cached in ordinary client query state.
Fail-closed integrations
Missing credentials, stale subscriptions, unexpected resource paths, oversized content, and unsupported file types block processing instead of widening access.
What “HIPAA-aligned” means here.
The product uses privacy and security design patterns relevant to regulated healthcare operations: role limits, minimum necessary, auditability, data separation, secure integration boundaries, and supervised use. Actual HIPAA compliance also depends on contracts, configuration, policies, workforce training, and each deployment’s operating environment.
No autonomous clinical decisions
AI does not diagnose, prescribe, or replace authorized clinical judgment.
No silent external completion
Internal state does not claim a send, submission, fill, result, or payer response without evidence.
No public PHI collection
Marketing and demo-request pages instruct visitors not to submit patient information.
No active email content
The protected full-message reader strips scripts, forms, remote images, unsafe links, and other active content.
Pilot discussion
Review security boundaries before planning a pilot.
Public subscription pricing is not yet published. A pilot discussion can evaluate workflow fit, security boundaries, and implementation scope without collecting patient information.