SECURITY
Information security
Where is medical information stored and processed, and who can use it? This page explains how MedSync manages and protects information.
PREMISES
Core principles for safe use
Designed for securityBuilt with Japan’s “3 Ministries, 2 Guidelines” for medical information security in mind
Data kept in JapanHosted in a cloud environment in Japan
Not used for AI trainingYour inputs are not used for training
A person makes the final checkAI output is reviewed by a person
CHECKPOINTS
Four things to check before you start
When a medical institution chooses an AI or cloud service, features alone are not enough to go on. Below, we explain where information is stored and processed, who can access it, what is recorded, and what is sent outside.
- Where is information processed?
- Who can access it?
- What information is recorded?
- What is sent outside?
DATA
Guidelines and where data is stored and processed
For eligible services, all processing, AI included, stays in Japan. These services can also be deployed on a closed network that is not connected to the internet.
Following the guidelines
Our design follows the medical information security guidelines issued by Japan’s Ministry of Health, Labour and Welfare (MHLW), Ministry of Internal Affairs and Communications (MIC), and Ministry of Economy, Trade and Industry (METI). For each deployment, we set out which responsibilities rest with your facility and which rest with MedSync.
Keeping data in Japan
We store the following data in your facility’s dedicated cloud environment, encrypted both in transit and at rest.
- Recordings and transcripts
- Records you create
- In-house documents you register
ACCESS
AI training and access permissions
We do not use the information you entrust to us to train AI models.
Our servers check which services each user is authorized to use.
Not used for AI training
Neither your inputs nor the generated output is used for training. Instead, we improve the output by refining our prompts (written instructions to the AI). Data excluded from training includes:
- Audio recordings
- Draft clinical notes written by AI
- Chat conversations
Verifying who connects
We use multi-factor authentication (MFA), which combines a password with a second way of verifying identity. Sessions lock automatically 180 minutes after sign-in.
For
- Client certificates
- IP restrictions
*The connection method depends on your environment.
RECORDS
Data retention and external transmission
In
Keeping activity logs
We record who performed which operation, and when. Each activity log entry is digitally signed and linked to the others, so the log can later be checked for tampering. The activity log does not include patient names or the text of queries sent to the AI. It is kept separately from the clinical records and conversations stored in the service.
Checking outbound data for patient information
When you use an external service such as web search, your input is checked before it is sent. If it contains patient information, the search is canceled altogether. Text returned by the AI is checked in the same way. Each staff member must give their own consent before using this search.
RESPONSIBILITY
Review and responsibility stay with healthcare professionals
The AI is designed not to add anything beyond what is in the input. Because it can still generate incorrect content, a person must review everything it writes.
In
Everything the AI creates is a draft. Healthcare professionals review and edit it, and they bear final responsibility.
*Specifications vary by service and contract.
CONTACT
Let’s talk about how your information is handled.
Based on your environment, we’ll walk you through where your information is stored and processed, and what your facility and MedSync are each responsible for managing.
