How Gia Handles Protected Health Information

A business associate agreement with every customer, results written to your own EHR, and a clinician between every output and every action.

How does Gia handle PHI under HIPAA?

Compliance officers ask the same four questions of every vendor. Where is the agreement, where is the data, who sees it, and what does the record keep. Here are the answers for Gia.

The cost of getting this wrong is a breach notification, a corrective action plan and a board conversation. The cost of getting it right is one agreement, one data-flow diagram and a clinician in the loop. The second is cheaper. Here is how it is built.

The agreement comes before the data

No protected health information moves until a business associate agreement is signed. One BAA per customer. It names the permitted uses, the safeguards and the breach obligations, the way HHS guidance describes.

Your compliance officer reviews it. Your counsel signs it. Then the integration is switched on.

The BAA also settles who is responsible for what. Scienza is the business associate. The facility, the plan or the system is the covered entity. Subcontractors are named. Breach notification timelines are written down. There is no version of the deployment in which the agreement follows the data.

Where the data lives

Results, notes and follow-up write back to your EHR: PointClickCare, Epic or the system you already run. The chart of record stays your chart of record.

Gia Health Analytics is hosted by Scienza and sold through the AWS Marketplace and Google Cloud Marketplace. The foundation model for aging reads a prepared export from your records and never trains on it.

This matters for more than compliance. When results live in your chart, your clinicians read them where they already work. When the analytics are hosted by Scienza, your team has one prepared export to review and an aggregate report to read. On-premises deployment is coming soon.

Who sees what

The clinician sees the ranked worklist, the reasons and the Proactive Decision Actions. The clinician decides. Nothing is ordered by Gia.

Families see updates after a clinician releases them, not before. Caregiver check-ins follow the same rule. A check-in is a screening conversation. Gia is clinical decision support, not a diagnosis.

The same rule applies to the population side. Gia Health Analytics returns aggregate reports to the plan or the system. The clinician, not the report, decides what happens to any one member, and that decision is recorded in the clinician's name.

A check-in produces a comparison with the resident's earlier calls and a position on the worklist. It produces no label. What the comparison means for this resident is the clinician's call, and the chart records it as such.

What the record keeps

Every call attempt. Every result. Every clinician decision and the follow-up assigned. Dated and attributed, in the follow-up record and in your EHR.

That is the record a privacy officer needs for an access review and a surveyor needs for a documentation review. The same record serves both.

Each check-in is a dated, attributed entry. Each retry after a missed call is recorded as an attempt. Each structured assessment the clinician initiated, the BIMS, a cognitive screening, or an ADL and IADL review, lands in the chart in the window it was administered. The record is built as the work happens, not reconstructed before a survey.

Four questions to put to any vendor

Is there a BAA, and is it signed before data flows? Where does PHI live, and does it leave our environment? Who can act on an output without a clinician? What does the audit trail hold, and can we export it?

Put them to us as well. See governance for the full posture.

A fifth question for the clinical side: what does the vendor say the tool is not? The answer should come quickly. Gia reaches residents between visits by phone or video, listens and reports. Gia places no orders, changes no medication and documents no condition. The clinician does all of that, in the clinician's name.

Where to start

Send the four questions to your compliance officer and your IT lead before the demo, not after. Ask for the BAA in the same email.

See how post-acute and senior living operators deploy Gia, then book a working session with your compliance officer in the room.