An agent that can't change your lab system
VektorDx is designed around HIPAA. We sign a Business Associate Agreement with your lab before any patient data is read, we use only services that sign one with us, and we encrypt data in transit and at rest. VektorDx reads, checks and reports; your staff and your clinics make every change. Here is what that means in practice, for your compliance officer.
HIPAA safeguards, a signed BAA, and encryption
Designed around HIPAA
We build to the HIPAA Privacy and Security Rules: unique logins and role-based access, an audit log of every access to patient data, only the minimum data each check needs, and a documented breach-notification process.
We sign a BAA
We sign a Business Associate Agreement with your lab before the first order is read. For anything that touches patient data, including AI models, the clearinghouse and hosting, we use only services that sign a BAA with us.
Encrypted in transit and at rest
We encrypt every connection with TLS: from your lab system, to the clearinghouse, and on clinic links. We encrypt databases, stored scans and backups at rest.
How the safeguards work
Read-only by design
VektorDx connects to your lab system with one read-only login. It runs reviewed, bounded queries on indexed fields, logs every call, and never writes, cancels or edits an order.
Synthetic data in demos
No patient data is used in demos or sales conversations. Every demo runs on synthetic orders.
Models covered by agreements
Requisitions are read only by AI models whose provider has signed a Business Associate Agreement with us, or that run on hardware we operate, and only the four regions the rules need. Patient data never goes to a consumer AI service. Stored scans are purged after 30 days.
Clearinghouse checks
Eligibility checks send only what the payer needs to find the patient's coverage: name, date of birth, member ID and date of service. They go through a HIPAA-covered clearinghouse, and every request and response is logged with its order.
One instance per lab
Each lab gets its own VektorDx instance and its own database, with row-level access controls. One lab's data is never mixed with another's.
Public rule sources
Checks come from published CMS sources: the ICD-10-CM code set, the Medicare ordering and referring file, and coverage determinations. Each rule cites its source and version.
Advisory, not authority
Findings say what is missing or unsupported, never which code to use. VektorDx doesn't submit claims, choose tests or suggest diagnosis codes. The lab director and billing team stay responsible.
Clinic links without a login
Each link holds a long random token stored only as a hash, expires after 14 days, and is upload-only. The page shows the minimum: accession, patient initials, collection date and what's needed. It runs as a small separate public service; VektorDx itself stays on the internal network.
Nothing on this page is legal advice. Your compliance officer decides what applies to your lab.