How compliance works here
Two separate questions get conflated: what happens to the data you type, and whether the resulting note satisfies your payer. Here are plain answers to both.
What happens to what you type
The note is composed entirely in your browser using JavaScript that runs on your device. There is no API call, no server-side processing, and no database. Nothing you type is transmitted to us, which means there is no server log containing it, no backup containing it, and nothing for us to breach. This is not a policy promise — it is a property of how the tool is built.
Why that matters more than a privacy policy
Most AI documentation tools work by sending your session content to a model provider. That creates a business associate relationship, requires a BAA, and puts your text in a third party’s systems. We avoid the entire chain by not needing it. If you are evaluating any documentation tool, the question to ask is not "are you HIPAA compliant" but "does my text leave my device, and if so where does it go."
When a BAA is relevant
A business associate agreement matters when a vendor creates, receives, maintains, or transmits protected health information on your behalf. Because NoteBirch does not receive your text, the relationship is different from a transcription or scribe service. Your practice may still want a written agreement for procurement reasons — ask us and we will provide our standard terms.
What the tool does not do
It does not make clinical decisions. It does not assess risk for you. It does not verify that a note meets a specific payer’s current policy, and payer policies change. It does not replace your clinical judgment about what belongs in a record. It organizes documentation you have already determined is accurate.
Payer requirements change — stay current
The language generated here reflects common expectations: skilled need, functional limitation, measurable goals, and the link between objective findings and assessment. Specific payers add requirements on top — prior authorization criteria, visit limits, required screening tools, and state Medicaid variations. Treat the generated note as a strong draft and apply your own knowledge of your payer.
Your record, your responsibility
The note that goes into the chart is yours. Edit the draft until it accurately reflects what happened. If a generated sentence does not describe your session, delete it. The tool exists to remove the typing, not the judgment.