Privacy and data security, built for patient care.
VeriMedic captures body-camera footage of real patients on real calls — so protecting that data is core to everything CaseSync does. We're built for HIPAA from the ground up, we sign a BAA with every agency, and our security posture is monitored continuously with Vanta.
Built for HIPAA from the ground up.
VeriMedic captures body-camera footage of real patients on real calls. Protecting that data isn't a feature we added — it's the foundation the whole platform is built on.
HIPAA by design, not bolted on
CaseSync handles protected health information from the first frame of footage — so HIPAA wasn't an afterthought. Access controls, encryption, and audit logging are built into how the platform captures, reconciles, and stores every call.
Business Associate Agreements
VeriMedic signs a Business Associate Agreement with every agency. We treat body-camera video, monitor data, and the NEMSIS fields drafted from them as PHI, and handle them under the same obligations your agency is held to.
Encrypted end to end
Footage and clinical data are encrypted in transit and at rest. Video captured on the body camera is protected from the field to the cloud, and stays encrypted in storage where only authorized reviewers can reach it.
Least-privilege access
Crews, QA reviewers, and administrators each see only what their role requires. Every view, export, and edit is tied to an identity and written to an immutable audit log, so access to patient footage is always accountable.
How your data is protected at every stage.
From the moment a body camera turns on to the day a record is disposed of, CaseSync applies controls at each step of the data lifecycle.
| Lifecycle stage | Control in place |
|---|---|
| Capture | Body-camera video, monitor data, and CAD are captured as PHI and encrypted on the device before they ever leave the field. |
| In transit | Data moves to the cloud over encrypted connections (TLS), so footage and clinical fields are protected end to end on the way up. |
| At rest | Video and reconciled records are stored encrypted at rest in access-controlled cloud infrastructure — no PHI sits in the clear. |
| Access | Role-based, least-privilege access governs who can view or export a call. Crews, QA reviewers, and admins each see only what their role allows. |
| Audit | Every view, edit, and export is written to an immutable audit log tied to an identity, so access to patient footage is always accountable. |
| Retention & disposal | Footage and records follow retention rules set with your agency, and are securely disposed of at the end of their lifecycle. |
See our controls for yourself.
VeriMedic runs continuous compliance monitoring with Vanta. Our Trust Center gives you a live, always-current view of our security posture, policies, and the documentation your compliance team needs.
Privacy & data security: common questions
Straight answers for compliance officers, medical directors, and operations leaders evaluating VeriMedic.
- Is VeriMedic HIPAA compliant?
- Yes. VeriMedic handles body-camera footage, monitor data, and the NEMSIS fields drafted from them as protected health information, and is built for HIPAA compliance from the ground up — with encryption, role-based access, and audit logging. We sign a Business Associate Agreement with every agency.
- Who owns the body-camera footage and patient data?
- Your agency does. VeriMedic processes footage and clinical data on your behalf as a business associate under a BAA. We don't sell it, and we don't use patient data for anything beyond delivering CaseSync to your agency.
- How is patient footage protected?
- Footage is encrypted on the body camera, in transit to the cloud, and at rest in access-controlled storage. Only authorized reviewers on your team can access a call, and every view, export, and edit is written to an immutable audit log.
- Can I see VeriMedic's security posture and policies?
- Yes. VeriMedic runs continuous compliance monitoring with Vanta and publishes a live Trust Center where you can review our security posture, policies, and documentation your compliance team needs.
- Does VeriMedic sign a Business Associate Agreement?
- Yes. A BAA is standard for every VeriMedic agency. Because CaseSync captures and processes PHI, we take on the same obligations to protect that data that your agency is held to.
Have a security or compliance question?
Our team is happy to walk your compliance officer or medical director through how CaseSync protects patient data, and to share the documentation your review requires.