This page describes a suggested configuration, not legal advice. Your signed BAA determines Almanac’s contractual responsibilities. Confirm your configuration with the Almanac team and your privacy or security officer.
Understand shared responsibility
Your BAA covers how Almanac handles the information you provide. Your organization remains responsible for its devices, access policies, connected services, and use of the product.
Devices and workstations. Use your organization’s requirements for device encryption, screen locks, browser access, and physical privacy.
Plugins and connectors. Each connected service is a separate destination for data. Confirm that your organization has the appropriate agreement with the provider before allowing it to receive PHI.
Require appropriate sign-in
Use single sign-on when your organization manages access through an identity provider. This keeps provisioning and removal connected to your existing directory.
See Authentication.
Review your responsibilities
Your organization is responsible for:
- Completing its own risk analysis.
- Securing members’ devices and workstations.
- Granting and removing access.
- Approving plugins, connectors, and other data destinations.
- Training members on appropriate use.
- Reviewing configuration after relevant product or policy changes.
Configure Almanac for PHI
The following settings provide a starting point. Set policy controls as organization requirements when members shouldn’t be able to change them.
| Setting | Suggested configuration | Purpose |
|---|---|---|
| Sign-in | Require SSO | Keeps access aligned with your directory |
| Joining | Invitation only | Requires explicit authorization |
| Approval mode | Ask for approval | Pauses before file edits and commands |
| Plugins and connectors | Administrator approved | Limits data destinations |
| Web access | Restrict to an allowed list | Limits which websites Almanac may use |
| Patient context | Use your connected EHR | Preserves existing EHR access |
| File uploads | Allow with a defined retention policy | Supports document workflows while controlling retention |
| Memory | Off by default, with member choice | Makes cross-conversation context a deliberate choice |
| Retention | Match your records policy | Aligns stored content with organization requirements |
Review plugins and connectors
For every plugin or connector, determine:
- What information leaves Almanac.
- Which service receives it.
- Whether your organization has the required agreement with that service.
Connectors to your own systems use a member’s existing access. Review third-party destinations separately.
Prepare for rollout
- Complete the BAA and your organization’s risk analysis.
- Configure SSO and verify your domains.
- Assign administrators and define who removes access.
- Set organization requirements before inviting members.
- Approve only the plugins and connectors your organization has reviewed.
- Train members on appropriate use and incident reporting.
- Review configuration regularly and after significant changes.
Almanac security practices
Almanac restricts and logs access to production systems, encrypts data in transit and at rest, and doesn’t use customer conversations to train models.
Current architecture, subprocessors, and control information are available during a security review.
See Compliance, Privacy and data, Permissions, and Rolling out Almanac.