Security and compliance: how Bond handles PHI

Where does PHI go in a Bond deployment?

Bond touches protected health information (PHI) at four points. Each happens under the business associate agreement (BAA) between Bond and the site or health system, and the platform keeps an audit trail.^⁠[1]

1. 1

   Identify reads the chart

   Identify reads the EHR through FHIR R4 APIs, HL7 v2 where applicable, or an integration partner. It checks structured fields and clinical notes against the study's inclusion and exclusion criteria, ranks candidates, and shows the evidence for each criterion.^⁠[1]

2. 2

   The coordinator reviews matches

   Ranked candidates appear in Bond's dashboard with criterion-to-evidence rationale. Access is set by role, and sign-in can run through the site's own identity provider by SSO.^⁠[1]

3. 3

   Engage contacts the patient

   Engage runs voice and SMS agents from scripts configured for each site and study. The agents pre-screen, schedule, and escalate to a coordinator when needed or when the patient asks.^⁠[1]

4. 4

   Consent support explains, the site consents

   Consent gives plain-language explanations and answers patient questions about the consent form. The investigator or delegated site staff still obtain consent.^⁠[1]

Engage also connects directly to Google Sheets, CTMS and calendars.^⁠[1] Data synced to one of those falls under that system's access controls, so list each connection in your risk analysis.

How is it configured and checked before go-live?

• Setup. Implementation covers the EHR connection, security review, audit logging setup and workflow configuration, all in the volume-based platform fee, with no separate integration fee. See pricing.^⁠[1]
• Scripts. Outreach scripts are configured per site and study.^⁠[1] FDA expects the IRB to review recruitment material and its mode of communication, so they go in your IRB package.^⁠[14] See the IRB and HIPAA outreach guide.
• Validation. ICH E6(R3) expects computerized systems used in trials to be fit for purpose, for example through risk-based validation, and leaves the investigator to decide whether a service provider is appropriate.^⁠[13] Ask Bond how its configuration is tested against your protocol.

How does this compare with a manual workflow?

What does the BAA commit Bond to?

Under HIPAA, a vendor that creates, receives, maintains or transmits PHI on behalf of a covered entity is a business associate.^⁠[4] Bond is one and signs a BAA with each site or health system.^⁠[1] HIPAA requires that written agreement before a business associate handles the site's PHI.^⁠[10] The BAA glossary entry covers the required contents. Four terms matter most here:

• Safeguards. Bond must comply with the HIPAA Security Rule for the electronic PHI it handles.^⁠[6]
• Subcontractors. Any subcontractor that creates, receives, maintains or transmits electronic PHI for Bond must agree to the same requirements in its own contract.^⁠[6]
• Incident reporting. Bond must report security incidents to the site, including breaches of unsecured PHI (timeline below).^⁠[6]
• Return or destruction. When the contract ends, Bond must return or destroy the PHI it still holds where feasible, and extend the contract's protections to anything it cannot.^⁠[9]

What about the language models?

A company that hosts a language model and processes chart text or patient messages for Bond is a subcontractor under that rule.^⁠[6] HIPAA lets Bond share PHI with it only under a written agreement.^⁠[10] Ask which subprocessors, model providers included, handle PHI for your site.

Which security controls does Bond run?

The HIPAA Security Rule names five technical safeguards: access control, audit controls, integrity, person or entity authentication, and transmission security. Encryption is an addressable specification, not a required one.^⁠[5] Bond encrypts PHI regardless.^⁠[1]

What is Bond's compliance status?

• SOC 2 Type I and HIPAA. Bond is SOC 2 Type I compliant: independent auditor Advantage Partners has issued Bond's SOC 2 Type I report. Bond is also HIPAA compliant, and its SOC 2 Type II and ISO 27001 audits are underway.^⁠[2]
• Trust Center. Bond's Trust Center lists 73 HIPAA Security Rule controls, monitored continuously by Vanta.^⁠[3]

How does Bond keep PHI to the minimum necessary?

HIPAA's minimum necessary standard applies to business associates as well as covered entities: make reasonable efforts to limit the PHI used, disclosed or requested to what the purpose needs.^⁠[10] Three parts of a Bond deployment bear on it.

• Screening. Coordinators check the evidence Bond cites for each criterion instead of paging through the whole chart.^⁠[1]
• Outreach content. Scripts are configured per site and study,^⁠[1] so your team and IRB decide what a first text says. One option is to leave the condition out of it and confirm identity before discussing the study.
• Reporting. CRO and sponsor reporting covers enrollment metrics such as patients matched, contacted, consented and randomized.^⁠[1] Ask which fields each role can view.

FDA says a simple statement that "confidentiality will be maintained" does not tell the IRB enough about a screening script. Its example questions include what happens to personal information if the caller hangs up, and whether names of people who do not qualify are kept for other studies.^⁠[14] Get Bond's answers to both before you submit. The IRB submission language template gives wording sites can adapt.

How long is data kept?

Set retention and disposal terms in the BAA and services agreement. At the end of an engagement, HIPAA requires the business associate to return or destroy the PHI where feasible.^⁠[9] For security questionnaires: HIPAA's 6-year retention rule covers security policies and records of required security activities, not the patient data itself.^⁠[11]

How are patients told that AI is involved?

Patients contacted by Bond's voice or SMS agents are told AI assistance is used and can reach a person at any time: the agent transfers the call live to a coordinator or books a human callback, whichever the site prefers.^⁠[1],[2]

Some states regulate this; two examples as of September 2026. Since January 1, 2025, California has required health facilities, clinics and physician offices that use generative AI for patient communications about clinical information to include an AI disclaimer (spoken at the start and end of a call) and a way to reach a person, unless a licensed provider reviews the message. Scheduling and other administrative matters are excluded.^⁠[15] Since January 1, 2026, Texas has required providers that use AI in health care services to disclose it in plain language by the date the service is first provided.^⁠[16]

What happens if there is a breach?

A breach at one vendor can reach the patients of many providers at once. HHS's Office for Civil Rights (OCR) reported these figures for 2024 to Congress, as summarized by HIPAA Journal:^⁠[17]

Most of that total came from a single breach at Change Healthcare, estimated at 192 million individuals.^⁠[17] Encryption matters legally: notification duties attach to unsecured PHI, meaning PHI not made unusable, unreadable or indecipherable to unauthorized persons by a method HHS specifies.^⁠[8]

If Bond discovers a breach of unsecured PHI, it must notify the site without unreasonable delay and no later than 60 calendar days after discovery, identifying each affected individual where possible.^⁠[7] The site, as the covered entity, notifies patients and HHS, and can set a shorter window in the BAA.

What does Bond not do?

• No FDA clearance. Bond holds no FDA clearance or approval for its software.
• No IRB approval. Bond claims none. Each site submits its own recruitment materials and chooses its HIPAA pathway, such as a review preparatory to research or a waiver of authorization.^⁠[12]
• No consent on the site's behalf. The investigator or delegated staff obtain consent.^⁠[1]
• No eligibility decisions. Bond ranks candidates and shows its evidence. The study team decides who is eligible.
• No substitute for the site's HIPAA program. The site remains the covered entity, with its own risk analysis and policies.

What should your security reviewer ask for?

• Bond's BAA, including subcontractor, incident and termination terms
• The current list of subprocessors that handle PHI, model providers included
• Encryption details, and the scope and date of the most recent penetration test
• A walkthrough of roles, SSO and the audit trail for your site
• Any Google Sheets, CTMS or calendar connections, and what data each one receives
• The AI disclosure language the agents use, for your IRB submission

HHS's January 2025 proposed Security Rule update would require encryption of electronic PHI at rest and in transit with limited exceptions, penetration testing at least once every 12 months, and written verification of each business associate's technical safeguards at least once every 12 months.^⁠[18] As of September 2026 no final rule had been published, and the eCFR still lists encryption as addressable.^⁠[5]

Security review runs inside implementation, and full EHR integration typically takes 48 hours, depending on the EHR, IT review and interface method.^⁠[1] See implementation for the plan, and the AI recruitment vendor evaluation checklist to compare vendors.