Question 1

Is Citeline Health HIPAA compliant?

Accepted Answer

Yes. Citeline Health is HIPAA compliant and operates as a Business Associate under HIPAA. We sign a Business Associate Agreement with every covered entity we work with and implement the administrative, physical, and technical safeguards required by the HIPAA Security Rule.

Question 2

Does Citeline record prior authorization calls?

Accepted Answer

Yes. When a medical reviewer joins the call, Citeline records the conversation and generates a transcript to support the case record and any related appeals. Call Data — audio, transcript, and metadata — is classified as PHI, encrypted at rest, and retained for the period necessary to support the case and any appeals, plus any additional period required by applicable law.

Question 3

Where is my data stored, and who can access it?

Accepted Answer

Data is stored with cloud infrastructure providers bound by Business Associate Agreements. Access to PHI is restricted to Citeline personnel on a need-to-know basis, with access controls and audit logging in place. PHI is not shared with third parties outside the scope of delivering the service.

Question 4

Can Citeline access my patients' information?

Accepted Answer

PHI is accessible only to Citeline personnel for the purpose of operating the service — placing calls, navigating phone trees, and supporting technical issues. It is not browsed, sold, or used for any purpose outside the scope of your prior authorization calls. All staff with PHI access undergo HIPAA training.

Question 5

Does Citeline sell or share patient data?

Accepted Answer

No. Citeline does not sell, rent, or lease Personal Information or PHI to any third party. We do not share data with advertisers, pharmaceutical companies, or data brokers. The only disclosures are to the insurance company during the call (as required to conduct the prior authorization) and to service providers bound by BAAs.

Question 6

What happens if there is a data breach?

Accepted Answer

We have incident response procedures in place for potential security events. In the event of a breach of unsecured PHI, Citeline will notify affected individuals, covered entities, and the U.S. Department of Health and Human Services in accordance with the HIPAA Breach Notification Rule (45 CFR §§ 164.400–414).

Question 7

Can I request deletion of my data?

Accepted Answer

Yes. You can delete your account from the app under Settings → Delete Account, which removes your profile, case data, and call recordings from production systems. Data may persist in encrypted backups for up to 30 days before permanent purge. To submit a formal deletion request, email privacy@citelinehealth.com.

Built by clinicians,
for clinicians.

Six promises about your data.

What does Citeline do with your data?

You create a case.

Most AI tools treat your data as a resource. We don't.

Common questions about privacy & security.

We're here for privacy and security questions.

Built by clinicians,for clinicians.