What will our IT team need before patient information goes in?

Getting a new tool approved shouldn't take longer than deciding you want it. EMSSOAP hands your reviewers what they need up front: a signed BAA, an independent SOC 2 Type II report and plain answers on how patient information is protected.

Whether the review sits with IT, risk management or legal, you can start with a clear description of the workflow and the documentation behind it. Here is what to share, how agency access works and how to move from review into a pilot.

What to send your reviewers

Give your reviewers a starting point they can use:

• The security page, which describes encryption, access controls, backups and security monitoring.

• The Business Associate Agreement for their review and signature before real patient information is used.

• A request for the full SOC 2 Type II report through the EMSSOAP Trust Center.

• The Getting Started guide, which explains the documentation workflow and requirements.

• Your proposed pilot scope: participating staff, the person managing accounts and the documentation workflow you want to evaluate.

That last item is your agency's part of the conversation. Identifying it early gives reviewers a concrete use case to assess and gives your team a clear starting point for the pilot.

The agreement comes first

EMSSOAP signs a Business Associate Agreement with your agency before patient information is used. The security page also confirms signed BAAs with every subprocessor that handles protected health information on its behalf.

Agencies that want to try EMSSOAP before a BAA is signed can use mock scenarios with no real patient data. It's a quick way to see the whole platform at work, including AI voice dictation, LiveQA and the quality of the finished narratives.

Use those scenarios to work through the steps your crews would follow. Dictate the encounter, review the transcription and examine the finished narrative. This gives your team something specific to discuss while the required written agreement is being reviewed.

The evidence behind the safeguards

EMSSOAP's security documentation covers the controls your reviewers can examine:

• An independent audit. EMSSOAP has completed a SOC 2 Type II examination covering the Security criteria.

• Encryption. Data stored in the database is encrypted with AES-256. Data moving between your browser and EMSSOAP's servers uses TLS 1.2 or higher.

• Access control and audit logging. Admin, Manager and Member roles determine access to organizational data and features. Access is role-based and audited, with multi-factor authentication for platform administrators.

• Backup and recovery. Automated daily backups are encrypted and stored in geographically separate locations. Point-in-time recovery supports restoration within the retention window.

• Monitoring and incident response. Security controls are monitored continuously. A documented incident response program covers detection, containment, eradication and recovery.

• HIPAA safeguards. EMSSOAP implements the administrative, physical and technical safeguards required by the HIPAA Security Rule.

The full SOC 2 report is available on request through the EMSSOAP Trust Center. We also work closely with your reviewers during the approval process to provide any documentation they need.

Your agency manages staff access

Your agency can assign responsibility for account management before the pilot starts.

Agency managers use Manage to invite one person or a group, change an existing user's role and remove accounts. Members do not have access to organization management. The organization management guide lays out those steps.

For the pilot, choose who will manage invitations and access changes. When someone joins the evaluation, changes responsibilities or leaves, that person has a documented process to follow.

Agency-wide changes, such as updating protocol documents or changing the narrative format, are handled with EMSSOAP. Your manager can request those changes through contact@emssoap.com.

What happens to your documentation

EMSSOAP uses the patient-care details your crew types or dictates to generate a narrative in your agency's documentation format. After dictation, the transcript appears for review and editing. Narrative generation begins when the user selects Send.

The crew member reviews the finished narrative, then copies and pastes it into the ePCR. The Getting Started guide explains that workflow so reviewers can understand how the tool will be used.

Your narratives and dictations are never used to train AI models or shared with other agencies or customers, according to the FAQ. Your protocols configure your agency's own setup.

Bring your reviewers

Invite whoever handles IT, risk management or legal review to a 30-minute call. We can walk through the security evidence and the BAA alongside your agency's proposed workflow.

The call also starts the pilot conversation: which staff will participate, which protocols and preferences to configure, and how your team wants to receive support.

Once the required written agreement, including the BAA, is in place, your agency can evaluate EMSSOAP with real patient information during a free six-week pilot. The program includes setup and training, ongoing support and check-ins, and a results review before you decide whether to continue.

Book a 30-minute call and bring the people who need answers before your crews begin.