The compliance framework applied to Atel Q Voice AI deployments in the United Kingdom and to qualifying healthcare deployments in the United States.
UK deployments are operated under Atel Q's data-protection framework, designed to support compliance with UK GDPR and the Data Protection Act 2018, as amended.
HIPAA-enabled deployment is available where a qualifying US healthcare organisation requires Atel Q to process Protected Health Information.
Compliance controls are applied according to jurisdiction, the type of information being processed and the role Atel Q performs within the deployment. Enhanced healthcare controls are enabled before regulated patient information is introduced where required.
Where Atel Q processes personal information on a client's instructions, the client will normally act as Data Controller and Atel Q as Data Processor, subject to the actual processing arrangement.
Health information is treated as special category personal data and is handled with the additional safeguards appropriate to that data.
For qualifying US healthcare organisations, Atel Q can activate a separate HIPAA-enabled deployment before the service begins creating, receiving, maintaining or transmitting PHI.
Required Business Associate arrangements, security controls and deployment checks are completed before production PHI is introduced.
These controls form the baseline for Atel Q deployments and are strengthened where regulated healthcare information is involved.
Voice AI workflows are configured to collect only information needed for the relevant interaction, workflow or authorised business purpose.
Client data is processed for agreed services and authorised workflows and is not intentionally repurposed for unrelated activities.
Access to client environments and sensitive information is restricted according to operational need and authorised user responsibilities.
Administrative access is protected by appropriate authentication and account-security controls, with enhanced requirements for regulated deployments.
Where required, activity can be evidenced through interaction records, workflow history, system logs and authorised-user activity.
Retention is configured according to purpose, contractual and legal requirements. Security incidents are assessed and escalated under the applicable response process.
Healthcare workflows are configured to avoid unnecessary collection of clinical detail. The client's clinical or practice-management system remains the authoritative clinical record unless a different arrangement is expressly agreed.
HIPAA controls are not activated simply because a service is being discussed, demonstrated or tested. They are enabled before a qualifying US healthcare deployment begins processing production PHI.
| Scenario | HIPAA status |
|---|---|
| UK healthcare deployment operating under UK data-protection requirements | UK framework applies |
| Sales discussion, demonstration or testing using synthetic or non-patient data | No HIPAA activation required |
| US dental or healthcare practice assessing the service before production use | HIPAA-ready deployment demonstrated |
| Qualifying US healthcare practice will process real patient PHI through Atel Q | HIPAA activation required before go-live |
| An existing deployment is changed so that it will begin processing production PHI | HIPAA activation required before the change goes live |
Confirm the client's HIPAA status, intended use and whether PHI will be processed.
Put the required Business Associate and contractual arrangements in place through the delivery chain.
Activate Atel Q's HIPAA-enabled healthcare environment for the relevant deployment instance.
Confirm authorised users, permissions, administrative access and operational responsibilities.
Review Voice AI, data capture, communications, escalation and handling rules against the approved healthcare configuration.
Complete pre-live testing without production PHI. Live patient information is introduced only after the environment is approved for use.
The fee reflects the additional regulated infrastructure, contractual arrangements, security controls and ongoing compliance management required for a HIPAA-enabled deployment.
The recurring fee applies per deployment instance and begins when HIPAA controls are activated for that instance. It is additional to the standard Voice AI service charge.
Deployment instance: a separately configured Atel Q Voice AI environment associated with a particular practice, brand, website, location or separately configured service. A single organisation may therefore operate more than one deployment instance.
No HIPAA-enabled deployment fee applies solely for proposals, demonstrations or pre-production testing that does not use production PHI. The applicable monthly fee is confirmed before activation.
Atel Q's controls operate alongside the responsibilities of the organisation using the service.
Atel Q's compliance framework is informed by guidance issued by the UK Information Commissioner's Office and the U.S. Department of Health & Human Services.