Your clients' data stays under your control.
Our software is built around one principle: client information goes only where you send it. It's between you and Anthropic. Nothing is ever sent to AssessForge.
Claude, by Anthropic
Your own account, with a signed Business Associate Agreement. Your data isn't used for training.
The software and your files
Records, notes and work histories stay on your machine.
No client data
We receive a periodic licence check. Nothing else.
The safest way to use AI with medical information.
Turn on HIPAA protection in your Claude API account and Anthropic's Business Associate Agreement (BAA) covers what you send. It's free and takes a few minutes.
The Claude chat app
Claude's regular chat app on Free, Pro, Max and Team plans can't be covered by Anthropic's Business Associate Agreement. Don't paste client health information into it.
Your Claude API account
You turn on HIPAA protection yourself, in a few minutes. This is the account our software connects to, which makes it the most practical way for a practice to use Claude with private medical information.
Anthropic's Enterprise plans can also be covered, through Anthropic's sales team.
What the agreement commits Anthropic to
- Using and disclosing health information only to provide the service
- Administrative, technical and physical safeguards
- Reporting a breach to you within ten business days of discovering it
- Never using your content to train its models
What it asks of you
- Create your API key in the HIPAA-enabled organization; only those keys are covered
- Keep health information out of organization names, your profile, billing details and support requests
- Read and follow Anthropic's HIPAA Implementation Guide
- Remember the setting is permanent for that organization
The programs can also connect through Amazon Bedrock or Google Vertex AI for organizations that already use them. Those services have their own agreements, which you would arrange with Amazon or Google.
Tools that limit what the AI sees.
Much of the work never leaves your computer. In CondenScribe, text recognition, duplicate finding, quote checking, word search, redaction and every export run locally. In OccuScribe, exploring, comparing, matching, the quick coder, the aptitude profile and every report run locally.
Privacy shield
CondenScribe and VocScribe. Names, phone numbers, addresses, SIN and health card numbers, and any other words you choose are replaced with placeholders such as [CLAIMANT] before text is sent, and put back in the answer you receive. It works on text, not on page images.
Redaction
CondenScribe. Boxes you draw are burned into every page image sent to the AI, and the words under them are left out of every text sent.
Anonymize
VocScribe. Replaces names throughout an assessment file before you share it, and restores them exactly.
Only what's needed
OccuScribe. The client's first name is never sent. Medical reports are sent only when you ask for recommended occupations.
Keys stay out of files
Your API key is stored in your Windows profile, never inside case or assessment files.
No client data to us
Our servers receive only periodic licence checks. They never see your files, notes or AI requests.
Clear commitments, under your own rules.
HIPAA is a U.S. law and doesn't apply directly in Canada. The agreement still gives you clear written commitments about how health information is handled. Your own obligations come from PIPEDA and provincial health privacy laws, such as Ontario's PHIPA and Quebec's Law 25. We recommend that you:
- tell clients their information may be processed by an AI service on U.S.-based infrastructure;
- check whether your province has stricter rules that apply to your work;
- send only the personal health information each task needs. The privacy shield and redaction tools help here.
This is general information, not legal advice.
Your responsibilities
Before sending regulated information, you are responsible for putting a BAA or equivalent agreement in place with your provider, reading and following its implementation guide, configuring your account securely, protecting your API key, informing your clients, and meeting your own legal and professional obligations. You remain responsible for every word of your reports, including checking AI drafts against your notes and sources.
AssessForge makes no representation that using its software will by itself satisfy HIPAA, PIPEDA or any provincial law. Please consult a privacy professional before processing real client data.
This website
When you request a trial or send us a message, we use your name, email and the details you provide only to respond and to issue your licence. Payments are handled by our payment provider; we never see your full card number.
Questions
Email contact@assessforge.ca.