1. Overview

The Smith Institute operates a Patient Story Collection System that enables individuals to share their healthcare experiences through an AI-guided conversational interface. These stories inform legal epidemiology research and may be used to support legislative testimony for healthcare policy reform.

This disclosure details the technical, administrative, and physical safeguards implemented to protect patient health information (PHI) in compliance with the Health Insurance Portability and Accountability Act (HIPAA) of 1996, the HITECH Act of 2009, and the HIPAA Omnibus Rule of 2013.

System Purpose

The Patient Story Collection System serves three functions:

1. Research Data Collection — gathering anonymized healthcare experiences to identify systemic patterns for legal epidemiology research
2. Legislative Testimony Recruitment — identifying individuals willing to share their experiences with state or federal legislators
3. Policy Advocacy — using aggregated, de-identified data to support healthcare policy reform efforts

System Components

• Patient-Facing Interface — three modes: embedded chat widget, multi-step guided form, and full-page conversation
• AI Conversation Engine — Anthropic Claude API providing trauma-informed, guided interviews
• Encrypted Data Store — WordPress database with AES-256-CBC encryption on all PHI fields
• Staff Administration Portal — secure WordPress admin interface for reviewing stories, managing testimony candidates, and logging communications
• Audit System — append-only log of all administrative actions involving PHI

2. HIPAA Applicability

Covered Entity Status

The Smith Institute collects personal health narratives that may constitute Protected Health Information (PHI) under HIPAA. Even when not operating as a traditional Covered Entity (healthcare provider, health plan, or healthcare clearinghouse), The Smith Institute applies HIPAA-equivalent security standards as a best practice to protect the sensitive health information entrusted to us by patients.

What Constitutes PHI in This System

What Is NOT PHI in This System

3. Data Collection & Minimization

Principle of Minimum Necessary

The system collects only the minimum information necessary for its stated purposes, in accordance with the HIPAA Minimum Necessary Standard (45 CFR § 164.502(b)).

Anonymous Submissions (Default)

By default, stories are collected anonymously. No identifying information is collected unless you explicitly opt in to the testimony program. Anonymous submissions contain:

• Healthcare narrative (encrypted)
• AI-generated summary (encrypted)
• Hashed IP address (for rate limiting only, not identification)
• Hashed user agent (for analytics only, not identification)
• Timestamp and interface mode

No name, email, phone, or other identifying information is collected for anonymous submissions.

Testimony-Interest Submissions

If you opt in to legislative testimony, you provide additional information voluntarily:

• Full name (encrypted)
• Email address and/or phone number (encrypted, at least one required)
• Contact preference (email or phone)
• Testimony format preference (written, video, or in-person)
• Explicit informed consent with timestamp

Data Never Collected

The system does not collect:

• Social Security numbers
• Medical record numbers
• Health insurance information
• Specific diagnoses or ICD codes
• Prescription information
• Provider names or facility identifiers — if you mention specific doctors, hospitals, or clinics during the conversation, our AI system will automatically use general terms (e.g., “my doctor,” “the hospital”) in any published summary
• Biometric data
• Financial information
• Date of birth
• Geographic data more specific than what you voluntarily share in your narrative

4. Encryption & Data Protection

Encryption at Rest

All PHI is encrypted at rest using AES-256-CBC (Advanced Encryption Standard with 256-bit keys in Cipher Block Chaining mode). This is the same encryption standard used by the U.S. government for classified information and is approved by NIST (National Institute of Standards and Technology).

Per-Field Encryption

Every encrypted field has its own unique, randomly generated Initialization Vector (IV). This means:

• Two identical plaintext values produce different ciphertext
• Compromising one field’s IV does not help decrypt other fields
• Pattern analysis across encrypted fields is not possible

Encrypted Fields

Hashing (Irreversible)

IP addresses and user agent strings are stored as SHA-256 hashes. Unlike encryption, hashing is a one-way function — the original value cannot be recovered from the hash. This provides rate limiting and abuse detection with zero risk of exposure in a data breach.

5. Access Controls & Authentication

Role-Based Access Control

Access to patient stories is governed by a custom WordPress capability assigned exclusively to authorized staff. Every admin page, every data handler, and every data access function verifies this capability before proceeding.

Authentication Requirements

No Public API for Decrypted Data

The public API endpoints accessible to patients never return decrypted stored data. They only create new encrypted records and return real-time AI responses. Decrypted data is only accessible through the authenticated staff admin interface.

6. Audit Trail & Logging

The system maintains an append-only audit log that records every administrative action involving PHI, in compliance with 45 CFR § 164.312(b).

Logged Actions

Audit Log Integrity

The audit log is append-only — entries cannot be edited or deleted through the application. Audit log entries contain no PHI, only metadata (user IDs, action types, resource IDs, timestamps).

7. Data Retention & Disposal

Retention Policy

Unpublished conversation records are subject to a configurable data retention policy (default: 365 days). A daily automated process checks for expired records and hard-deletes them — all associated data is permanently removed from the database.

Published stories: Once a story is reviewed, approved, and published on the website, it is exempt from automatic expiration and may remain available indefinitely. Published stories can be removed at any time upon request via the dispute process or by contacting The Smith Institute directly.

What Gets Deleted

When an unpublished record is deleted (whether by expiration or manual deletion):

• All encrypted conversation messages
• All encrypted contact information
• The AI-generated encrypted summary
• All associated admin notes and communications logs
• All hashed IP and user agent data
• All metadata (timestamps, status fields, preferences)

Deletion is irreversible. There is no “trash” or “soft delete” — data is permanently removed.

Audit Trail Preservation

Audit log entries are retained separately and survive story deletion. They contain no PHI — only the compliance record of who accessed and deleted the data.

8. Transmission Security

HTTPS Enforcement

All data transmission occurs over HTTPS (TLS 1.2 or higher). HTTP requests are automatically redirected to HTTPS. TLS certificates are managed and auto-renewed by our hosting provider.

No Client-Side Storage

Your conversation history is never stored in your browser (localStorage, sessionStorage, or cookies). Only a random, non-identifying session ID is temporarily stored and cleared when you close the tab.

CSRF Protection

All API requests include a security token that prevents cross-site request forgery attacks. These tokens expire after 24 hours and are validated on every request.

9. Third-Party Services

Anthropic (Claude AI)

Important: Your conversation text is sent to Anthropic’s servers for AI processing. This is necessary for the guided interview functionality. The text is transmitted over HTTPS and is subject to Anthropic’s data retention and privacy policies.

WP Engine (Hosting)

No Other Third-Party Data Sharing

Your data is not shared with any other third-party services, analytics platforms, advertising networks, or social media companies. The story collection pages do not use tracking pixels, social sharing buttons, or third-party widgets.

10. Anti-Spam & Abuse Prevention

• Rate Limiting: 10 requests per minute per user to prevent abuse
• Honeypot Fields: Hidden form fields that catch automated bots without affecting real users
• Input Validation: Message length limits (5–5,000 characters) and input sanitization
• No CAPTCHA: We deliberately avoid CAPTCHA to maintain accessibility and a compassionate user experience

11. Incident Response

In the event of a security breach involving PHI, The Smith Institute will:

1. Identify and contain the breach within 24 hours of discovery
2. Assess the scope — determine which records were affected
3. Notify affected individuals within 60 days (per HIPAA requirements)
4. Notify HHS if the breach affects 500 or more individuals
5. Document the incident in the audit log and internal records
6. Remediate — patch vulnerabilities, rotate encryption keys, update access controls

12. Your Rights

Right to Anonymous Participation

You may share your story completely anonymously. No identifying information is required. Anonymous stories cannot be linked back to you and are used for aggregate research only.

Right to Know What Is Collected

This disclosure details every data element collected, how it is protected, who can access it, and how long it is retained.

Right to Withdraw Consent

If you provided contact information for legislative testimony, you may request:

• Removal of your contact information
• Withdrawal from the testimony program
• Complete deletion of your story and all associated data

Right to Access

If you provided contact information, you may request a copy of your stored data. We will verify your identity and provide the data within 30 days.

Right to Amendment

You may request corrections to your stored data if you believe it is inaccurate. Amendments are processed within 30 days and logged in the audit trail.

To exercise any of these rights, contact The Smith Institute at info@thesmithinstitute.org.

13. Staff Responsibilities

All staff with access to patient health information are required to:

• Access only stories necessary for their assigned duties (Minimum Necessary Standard)
• Never share decrypted content via unencrypted email, messaging apps, or public discussion
• Never screenshot or copy decrypted patient stories to personal devices
• Log out when leaving their workstation
• Report suspected breaches immediately
• Use strong, unique passwords with two-factor authentication

Staff notes and communications are encrypted with the same AES-256-CBC standard as patient data, attributed to the staff member, and recorded in the audit trail.

14. Physical & Administrative Safeguards

Physical Safeguards

Administrative Safeguards

15. Compliance Summary