HIPAA Compliance

Where HIPAA Applies in Our Services

Electrome acts as a Covered Entity for the patient-facing services we operate directly (such as support for prescription fulfillment of RecoveryRx^®) and as a Business Associate when we provide provider services to a healthcare provider, clinic, or health system that is itself a Covered Entity.

• ActiPatch^® over-the-counter (OTC): Self-reported pain tracking and device-usage data submitted through the ActiPatch^™ Patient portal (self-service tier) are classified as PII (not PHI) while the user is a self-service consumer. This data becomes PHI when the user completes clinical onboarding (signs a HIPAA authorization) and the data is associated with provider-directed use of a prescription device.
• RecoveryRx^® (Rx): Prescription, diagnosis, and clinician communication data are full PHI subject to all HIPAA rules.
• Provider services: Operate under a signed Business Associate Agreement with each clinic or provider organization.

Your Rights Under HIPAA

If you are a patient of a healthcare provider that uses Clinical AI Concierge, or you receive RecoveryRx^® through our platform, you have the following rights regarding your Protected Health Information:

• Right to Access: Receive an electronic or paper copy of your designated record set.
• Right to Amend: Request corrections to inaccurate or incomplete records.
• Right to an Accounting of Disclosures: Request a list of certain disclosures of your PHI in the prior 6 years.
• Right to Restrict: Ask us to limit certain uses or disclosures.
• Right to Confidential Communications: Request that we communicate with you by alternative means or at alternative locations.
• Right to File a Complaint: File a complaint with us or with the U.S. Department of Health & Human Services Office for Civil Rights without retaliation.

Post-Quantum Cryptography Roadmap

Electrome is actively exploring FIPS 140-3 certified, post-quantum safe cryptography for data-in-motion, targeted for implementation in 2026. FIPS 140-3 is the U.S. federal cryptographic module standard published by the National Institute of Standards and Technology (NIST) and is recognized internationally (via ISO/IEC 19790) as the benchmark for validated cryptographic implementations used by regulated industries, including healthcare.

Today, the vast majority of the world's data-in-motion is protected by AES-based symmetric encryption negotiated through RSA and elliptic-curve (ECDH/ECDSA) key exchange. These public-key schemes are mathematically vulnerable to a sufficiently large, fault-tolerant quantum computer running Shor's algorithm, and symmetric keys face an effective halving of their security margin under Grover's algorithm. This creates a real-world "harvest now, decrypt later" risk: data intercepted today can be stored and decrypted years from now once quantum hardware matures.

The solution we are bringing in goes beyond swapping in NIST's post-quantum primitives (e.g., ML-KEM / ML-DSA, formerly CRYSTALS-Kyber and CRYSTALS-Dilithium). It is engineered so that intercepted ciphertext contains no exploitable mathematical relationship to the underlying plaintext or to the session keys. In practical terms, even stolen traffic cannot be reversed by Shor's, Grover's, or any currently known cryptanalytic attack — and remains resistant to future many-qubit quantum computers — because there is nothing in the captured bytes for those algorithms to solve.

We have already identified the world's leading provider of this technology. A proof-of-concept / pilot deployment is scheduled to go live in our sandbox environment in Q3 2026, ahead of broader rollout across PHI-bearing services.

Business Associate Agreement (BAA)

Healthcare providers, clinics, and health systems subscribing to Clinical AI Concierge are required to execute Electrome's standard BAA before PHI is exchanged. To request a copy of our BAA, contact our Privacy team.