HIPAA & PHI Training

Protected Health Information is any individually identifiable health information. In Speekr, PHI includes:

• Patient details — name, date of birth, diagnoses, goals and clinical history
• Uploaded records — reports, evaluations, session notes exported from your EHR, and other supporting records, whether uploaded as Word files or PDFs or pasted as text
• What Speekr found — treatment dates, visit counts, measurements and observations extracted from those records
• Templates — the format and voice Speekr learns from a patient's reference report
• Drafts and approved documents — progress reports, plans of care, re-evaluations, discharge summaries, initial evaluations and any other document drafted in Speekr

If it could identify a specific patient and relates to their health or treatment, it is PHI.

Your practice is the Covered Entity. Patients and their records belong to the practice, and the practice is responsible for how its clinicians use them.

Speekr is your practice's Business Associate. A practice owner accepts the Business Associate Agreement (BAA) once during onboarding, and it covers every member of the practice. No patient can be added until it is signed. Speekr handles PHI only to provide the service to your practice and does not use PHI to train or improve AI models.

Follow the minimum necessary rule. Upload or paste only the records Speekr needs to draft the document in front of you — typically the latest report or evaluation and the session notes for the current reporting period. Don't upload a patient's entire chart "just in case," and don't upload records for patients you aren't documenting in Speekr.

Every active member of your practice can view and work on every patient in the practice — view records, add records, draft and approve. Because access is shared, handle it responsibly:

• Open a patient's records only when you need them for your work.
• Never share your sign-in with anyone, including colleagues in your practice. Each clinician needs their own seat.
• Sign out when you finish on a shared or public device, and lock your screen when you step away. Speekr is a web app — if your browser is open, PHI may be visible.
• Owners and admins: invite only people who need access, and give them the lowest role that fits their job.

When you download or export a document, the PHI in it leaves Speekr. From that point, keeping it safe is your practice's responsibility, not Speekr's. Store exported files only in places your practice has approved for PHI, such as your EHR, and don't keep copies on personal devices or in personal email or storage.

Exporting a document does not submit or sign it, and does not mean a payer has accepted it.

When you send Speekr feedback or email support, include only the PHI needed to resolve the issue — often none. Describe the problem in general terms (for example, "the visit count on a progress report looks wrong") rather than pasting patient names or clinical text.

Email reminders from Speekr never contain patient-identifying information. If you ever receive one that does, treat it as a security incident (see Section 9).

Speekr uses AI to draft documents from your uploaded records and runs automated checks on each draft. Clinical approval is your responsibility. A draft is a suggestion until you review, edit and approve it. When reviewing:

• Read the whole draft and compare it against the supporting sources attached to it.
• Pay attention to anything Speekr flags, including conclusions not supported by the uploaded records and gaps in the information. Speekr is built not to add treatment events, measurements, scores or payer requirements that aren't in your records, and to surface missing information for you to resolve. AI can still make mistakes, so check every figure against its source.
• Visit counts are inferred from uploaded notes and are not confirmed until you confirm them. Check them before relying on them.
• Speekr does not interpret payer rules. You remain responsible for meeting payer and documentation requirements.

Approved documents cannot be silently overwritten, and Speekr records exactly who approved each one. Approve only when you are satisfied the document is accurate.

When a clinician leaves, a practice owner or admin should revoke their access in Speekr right away. Revoking a member ends their access immediately. The practice's patient records stay in place, and the person's open tasks are unassigned so someone else can pick them up.

A security incident is any event where PHI may have been accessed, used, or disclosed without authorization. Examples:

• Someone who shouldn't have access can see your practice's patients
• Your device is lost or stolen while signed in to Speekr
• You upload records to the wrong patient, or share PHI outside Speekr by mistake
• You receive a suspicious email asking for your sign-in details
• You notice unusual activity in your account

What to do: Stop the activity if you can. Email raj@speekr.app promptly with what happened, when, and what PHI may be affected, and let your practice owner know. Don't wait until you are certain, and don't try to investigate or cover it up yourself.

Patients' requests to access, amend or receive an accounting of their health information go through your practice, as the Covered Entity. If a patient asks you about their records, follow your practice's process. Speekr will help your practice respond as described in the BAA.