Business boundaries
Records are managed by organization; sharing within a group is distinguished from access between independent organizations.
Security & data
Medical data protected from design to operations
MedAgents controls who has access, where data is stored, and which services it passes through. The facility agrees on how permissions, backups, data export, and handover work before go-live.
- HIPAA compliance
- Information system security level 3+
- Law 91/2025/QH15 & Decree 356/2025
- FHIR R4 includes AuditEvent and Provenance
Compliance standards
Compliance with domestic and international regulations
HIPAAHealth data securityProtection of the privacy and security of health information under HIPAA (United States).
Level 3+Information system securityInformation system security assurance by level, from level 3 upward.
Law 91/2025Personal data protectionCompliance with Law 91/2025/QH15 and Decree 356/2025/ND-CP on personal data.
FHIR R4Healthcare data standardRecords AuditEvent and Provenance for data access and data origin.
Controls
Clear controls, agreed before going live
Roles & assignments
Permissions are granted by role, site, and department; they are verified using a representative account for each staff group.
History & audit log
Record the actions that need tracking, who may view the log, and an appropriate retention period.
Storage location & external services
Data is stored on permitted infrastructure in Vietnam; AI, messaging, and the call center are reviewed separately.
Export & handover
Agree on the data, formats, recipient rights and reconciliation method for export or end of service.
Backup & restore
The backup schedule, where copies are stored, and how restores are verified are set out in the agreement.
Permissions & audit logs
Each person sees only their own part of the work
Administrators grant access by role, data scope, and individual function; every permission change is written to the audit log.
- By role: manager, doctor, nurse, pharmacist, front desk, accountant.
- By scope: the whole clinic, by department, or by assigned patients.
- By action: view, create, edit, delete, sign off.
- Audit log: keeps a record of who changed permissions, and when.
AI with controls
AI drafts, the doctor signs off
The AI clinical assistant works only on data sources that have been selected and permitted, and every answer carries citations for verification.
- Select the source: the doctor decides which documents are included.
- Citations: every point is linked to a source in the record.
- Draft: AI content awaits the doctor's confirmation before it is saved.
- Audit trail: stores access history and the provenance of content.
Data lifecycle
Data protection at every step
From the moment the patient gives consent until the facility exports or hands over the data.
- Step 01CollectionPatients are informed and give consent when their health information is processed.ConsentData minimization
- Step 02StorageStored on approved infrastructure in Vietnam, with scheduled backups.Vietnam infrastructureBackup
- Step 03AccessPermissions by role and scope, with access logging.PermissionsAudit log
- Step 04Export & handoverExport to the FHIR standard, with reconciliation at the end of use.FHIR R4Handover
FAQ
Frequently asked questions
Who owns patient data?
The data belongs to the healthcare facility. The facility can export data in FHIR R4 format within the agreed scope.
Is data transferred abroad?
Patient health information is stored and processed on infrastructure permitted to be located in Vietnam. AI, messaging and call center services are reviewed separately during implementation.
Who can view patient records?
Only users granted permission by role, site, and department; their actions are logged.
What happens to the data if we stop using the service?
Both parties agree on the data, formats, recipients, timelines and reconciliation method for export and handover.
Discuss requirements for the facility's data
State your requirements for where data is stored, access rights, the systems to connect, and the assessment documentation to be provided.