Introducing ComplianceAX: HIPAA Compliance Software for Medical and Dental Practices
ComplianceAX turns the HIPAA assessment into one plain question at a time, with private AI that reads your own policies and quotes them back. Built by Southeastern Technical for medical and dental practices of any size, from a solo provider to a multi-location group, and for the IT vendors who serve them.
Ask anyone responsible for HIPAA at a medical or dental practice, whether that is a solo provider or a compliance officer at a twelve-location group, and you will get some version of the same answer. It is a spreadsheet somebody emailed them. It has a few hundred rows. It uses words nobody outside a law office says out loud. It gets opened in January, abandoned in February, and finished in a panic the week something forces the issue.
We know this because we have our own completed HIPAA workbooks sitting in a folder here, 223 questions apiece, and filling them out was miserable. Southeastern Technical is a covered entity’s business associate many times over. We do this work for ourselves and for the practices we serve across Greater Atlanta and North Georgia.
So we built the thing we wanted. It is called ComplianceAX, the AX stands for Assessment Experience, and it is live.
One question at a time, in words you already use
The central idea is almost embarrassingly simple. Instead of a grid of 223 rows, ComplianceAX shows you one question, on one screen, and nothing else.
The questions are written in plain English at an eighth-grade reading level. Not “Has the covered entity implemented procedures to regularly review records of information system activity.” Instead: “Who looks at who-opened-which-chart reports, and how often?” Every question carries a one-line explanation of why it matters, and you can expand that to the actual regulation if you want to see it.
Under the hood the catalog covers 282 HIPAA requirements across 195 questions, spanning the Security Rule’s administrative, physical and technical safeguards, the Privacy Rule, the Breach Notification Rule and your vendor obligations. You answer Yes, No, or Not Applicable. A “No” is never treated as a failure. It becomes a next step on your plan, with an owner and a due date.
Answers save as you type. You can skip anything and come back. You can hand a question to the person who actually knows the answer. Nobody has to sit down and do the whole thing in an afternoon, which is the single biggest reason these assessments never get finished.
There is also, deliberately, a calm scene behind each question, with optional nature sound and quiet music that stay off until you turn them on. That part draws raised eyebrows until people try it. Compliance work is dreaded work, and a tool people are willing to open is worth more than a tool that is technically complete.
The AI reads your policies, and it has to show its work
This is where most of the time goes in a traditional assessment: you know you wrote a policy covering this three years ago, somewhere, and you have to go find it.
ComplianceAX takes your existing documents, reads them, and pre-fills what it can before you answer a single question. You start the assessment already some distance in, and the system tells you honestly how far (“you are already 41 of 60 there”) and where that number came from.
The rule the AI operates under is the part we care most about. It may suggest an answer only when it can quote a sentence from your own document word for word. Not summarize. Quote. Software then checks that quote against the source document before it ever reaches your screen. If the quote does not verify, the suggestion is thrown away and the question comes to you as unanswered.
No quote from your document, no suggestion. That is the whole contract.
Everything the AI produces is labeled as a suggestion and counts for nothing until a person on your team accepts it, one at a time. There is no bulk-approve-everything button for ordinary suggestions. And there is a hard list of things the AI is not permitted to do at all: it does not calculate your score, it does not declare you compliant, it does not sign an attestation, and it does not decide whether an incident is a breach. Those are human decisions and the software is built so they cannot be anything else.
Your score is computed by ordinary code from fixed rules, weighted by how serious each requirement is. It moves when real answers and real evidence change, and for no other reason.
Private AI, which for a medical practice is the whole ballgame
Every model ComplianceAX uses runs privately, on hardware we own, in data centers we control. Your policies, your patient data, your incident records: none of it is sent to OpenAI, Google, Anthropic or any other public AI service.
We did not bolt this on for the marketing. Private AI is what Southeastern Technical does. We design, build and operate local AI systems for clients who cannot send their data to someone else’s cloud, and ComplianceAX runs on the same foundation. For a practice weighing whether an AI tool is safe to point at a drawer full of PHI, “it never leaves our building” is a different answer from “we have a business associate agreement with a large AI vendor.”
Every AI suggestion, and what your team did with it, is written to an append-only audit log that is hash-chained, which means tampering with an earlier entry breaks every entry after it.
Written down, actually done, and provable are three different things
Most compliance tools treat a policy document as proof. An investigator does not.
ComplianceAX keeps three separate facts for every requirement. Is it written down in a policy. Do you actually do it. Can you prove you do it with a dated sample. A requirement with a beautiful policy and no practice behind it shows up as exactly that, and gets a next step telling you how to close the gap rather than a green check that flatters you.
Upload a policy on any topic and the system pulls out each promise it makes and marks it We do this, Sometimes, or We do not. Weak policies get rated and can be redrafted from what you really do. Topics no policy covers get a draft to start from. Records you are already generating, incidents, signed attestations, training completions, vendor agreements, feed in as proof automatically.
The parts practices actually get wrong
A few areas account for most of the trouble we see in the field, and they each got their own treatment.
Vendors and business associate agreements. Practices routinely cannot produce a list of who touches their patient data. ComplianceAX gives you a prompt list to find them, then works out whether a given vendor needs a BAA based on what the company does and what it can reach, rather than leaving you to guess. Signed agreements are tracked with expiry dates and confirmed every year.
Training. Everybody gets the basics. Pass-through roles like a cleaning service get a short notice instead of a full course. Each additional duty adds its own topics. Assignment and completion are tracked per person, which is what the regulation actually asks for.
Incidents. A guided case file opens with the 60-day breach notification clock visible the entire time, walks the four-factor assessment, and keeps every stage in the record. A person makes the breach determination. Always.
Everyone else’s part. Compliance fails when it is one person’s side project. Questions can be routed to the staff member or vendor who owns them, each person gets their own dashboard of tasks, training and policies to sign, and email reminders go out when it is their turn. You review everything that comes back before it counts.
If someone comes asking
One click builds a dated packet: answers, evidence, policies with their version history, training records, business associate agreements, incidents, and the audit log. You can build it as of any date you choose, which matters when the question is what you knew in March.
Every HIPAA obligation traces to the question that covers it and the document that supports it. Evidence is kept for six years with the date and the name of whoever added it.
We will help you gather and present it. That is support and organization, not legal representation, and we will not pretend otherwise.
What we will not claim
There is no such thing as HIPAA certification. The Department of Health and Human Services does not certify anyone, and no vendor can hand you a certificate that means anything. Any product that tells you it will make you HIPAA compliant is making a promise it has no standing to make.
ComplianceAX will not guarantee you a clean audit, and neither will we. What it will do is make sure the work is done, the evidence exists, and the record is organized and dated when you need it. In our experience that is most of the distance between a practice that handles an investigation and one that does not.
It does not stop being useful when you grow
Nothing about this is limited to a single-provider office. A practice in ComplianceAX is made of sites, and physical safeguard questions are answered per site, because the answer about who holds the keys to the server room is genuinely different at each location. Scores roll up per site and per section as well as for the practice as a whole, so a group can see which location is behind without reading eleven separate reports.
Responsibility splits the same way. Sections have owners, the Privacy Official and the Security Official own what belongs to them by default, and a site manager can be scoped to their own location and see nothing else. Everyone gets their own task list rather than one person holding the entire assessment.
There are no user caps. Not ten admins, not twenty-five employees. If you have ninety staff across six locations, all ninety get training records and policy signatures, because that is what the regulation asks for and charging per seat to meet it never made sense to us.
For the IT companies reading this
If you are a business associate rather than a practice, you have your own HIPAA obligations and most of you are thinner on them than your clients assume. ComplianceAX has a separate assessment built for business associates, covering what applies to you rather than making you skip past questions about exam rooms.
How to see it
The platform is in use now. A demo runs about 30 minutes and walks through the assessment, the document-based head start, and what a finished record looks like at the end.
If you want the broader picture of how we build private AI systems, our Local AI practice covers the hardware and the approach, and our HIPAA compliance services page covers the work we do alongside the software.
ComplianceAX
Take a look at it yourself.
See the assessment, the document-based head start and a finished record. A demo runs about 30 minutes and you can book it straight from the ComplianceAX site.
Or call Southeastern Technical at (678) 807-6156.
Frequently asked questions
Does ComplianceAX make my practice HIPAA compliant?
No software can do that, and any product that says otherwise is selling you something. There is no government HIPAA certification to earn. What ComplianceAX does is get the work done and documented: every requirement answered, every answer backed by evidence with a date and a name on it, and a packet you can hand to an investigator. Compliance is a judgment a person makes about your practice. We give you the record that judgment rests on.
Where does the AI run, and does it see patient data?
Every model runs privately on hardware we own and operate. Your documents are never sent to OpenAI, Google, Anthropic or any other public AI service. The AI also has a hard limit on what it is allowed to do: it may suggest an answer only when it can quote a sentence from your own document word for word, and software checks that quote against the source before anyone sees it. No quote, no suggestion.
How long does the assessment take?
Setup is about two minutes. The assessment itself runs 195 questions across 282 HIPAA requirements, and most practices do it in sittings of fifteen or twenty minutes rather than one long day. If you upload your existing policies first, the AI answers a large share of it before you start, so you spend your time reviewing rather than typing.
What happens if we have a breach?
ComplianceAX opens a guided case file with the 60-day notification clock visible on the screen, walks through the four-factor risk assessment HIPAA requires, and keeps every step in the record. The determination of whether something is a reportable breach is made by a person, never by the software.
Is this only for small practices?
No. A practice is made of sites, physical safeguard questions are answered per site, and scores roll up per site and per section as well as for the whole organization, so a multi-location group can see which location is behind. Sections have owners, and a site manager can be scoped to their own location. There are also no user caps, so a ninety-person practice across six locations gets training records and policy signatures for all ninety people.
Can our IT provider or billing company use it too?
Yes, and they should. Business associates have their own HIPAA obligations and get their own assessment in ComplianceAX. A practice can also send individual questions to a vendor to answer directly, then review the response before it counts.
What do we actually get at the end?
A dated audit packet built in one click: your answers, the evidence behind them, policies and their version history, training records, business associate agreements, incidents, and the full audit log. Evidence is kept for six years with the date and the person who added it.
Introducing ComplianceAX: HIPAA Compliance Software for Medical and Dental Practices
ComplianceAX turns the HIPAA assessment into one plain question at a time, with private AI that reads your own policies and quotes them back. Built by Southeastern Technical for medical and dental practices of any size, from a solo provider to a multi-location group, and for the IT vendors who serve them.
Ask anyone responsible for HIPAA at a medical or dental practice, whether that is a solo provider or a compliance officer at a twelve-location group, and you will get some version of the same answer. It is a spreadsheet somebody emailed them. It has a few hundred rows. It uses words nobody outside a law office says out loud. It gets opened in January, abandoned in February, and finished in a panic the week something forces the issue.
We know this because we have our own completed HIPAA workbooks sitting in a folder here, 223 questions apiece, and filling them out was miserable. Southeastern Technical is a covered entity’s business associate many times over. We do this work for ourselves and for the practices we serve across Greater Atlanta and North Georgia.
So we built the thing we wanted. It is called ComplianceAX, the AX stands for Assessment Experience, and it is live.
One question at a time, in words you already use
The central idea is almost embarrassingly simple. Instead of a grid of 223 rows, ComplianceAX shows you one question, on one screen, and nothing else.
The questions are written in plain English at an eighth-grade reading level. Not “Has the covered entity implemented procedures to regularly review records of information system activity.” Instead: “Who looks at who-opened-which-chart reports, and how often?” Every question carries a one-line explanation of why it matters, and you can expand that to the actual regulation if you want to see it.
Under the hood the catalog covers 282 HIPAA requirements across 195 questions, spanning the Security Rule’s administrative, physical and technical safeguards, the Privacy Rule, the Breach Notification Rule and your vendor obligations. You answer Yes, No, or Not Applicable. A “No” is never treated as a failure. It becomes a next step on your plan, with an owner and a due date.
Answers save as you type. You can skip anything and come back. You can hand a question to the person who actually knows the answer. Nobody has to sit down and do the whole thing in an afternoon, which is the single biggest reason these assessments never get finished.
There is also, deliberately, a calm scene behind each question, with optional nature sound and quiet music that stay off until you turn them on. That part draws raised eyebrows until people try it. Compliance work is dreaded work, and a tool people are willing to open is worth more than a tool that is technically complete.
The AI reads your policies, and it has to show its work
This is where most of the time goes in a traditional assessment: you know you wrote a policy covering this three years ago, somewhere, and you have to go find it.
ComplianceAX takes your existing documents, reads them, and pre-fills what it can before you answer a single question. You start the assessment already some distance in, and the system tells you honestly how far (“you are already 41 of 60 there”) and where that number came from.
The rule the AI operates under is the part we care most about. It may suggest an answer only when it can quote a sentence from your own document word for word. Not summarize. Quote. Software then checks that quote against the source document before it ever reaches your screen. If the quote does not verify, the suggestion is thrown away and the question comes to you as unanswered.
No quote from your document, no suggestion. That is the whole contract.
Everything the AI produces is labeled as a suggestion and counts for nothing until a person on your team accepts it, one at a time. There is no bulk-approve-everything button for ordinary suggestions. And there is a hard list of things the AI is not permitted to do at all: it does not calculate your score, it does not declare you compliant, it does not sign an attestation, and it does not decide whether an incident is a breach. Those are human decisions and the software is built so they cannot be anything else.
Your score is computed by ordinary code from fixed rules, weighted by how serious each requirement is. It moves when real answers and real evidence change, and for no other reason.
Private AI, which for a medical practice is the whole ballgame
Every model ComplianceAX uses runs privately, on hardware we own, in data centers we control. Your policies, your patient data, your incident records: none of it is sent to OpenAI, Google, Anthropic or any other public AI service.
We did not bolt this on for the marketing. Private AI is what Southeastern Technical does. We design, build and operate local AI systems for clients who cannot send their data to someone else’s cloud, and ComplianceAX runs on the same foundation. For a practice weighing whether an AI tool is safe to point at a drawer full of PHI, “it never leaves our building” is a different answer from “we have a business associate agreement with a large AI vendor.”
Every AI suggestion, and what your team did with it, is written to an append-only audit log that is hash-chained, which means tampering with an earlier entry breaks every entry after it.
Written down, actually done, and provable are three different things
Most compliance tools treat a policy document as proof. An investigator does not.
ComplianceAX keeps three separate facts for every requirement. Is it written down in a policy. Do you actually do it. Can you prove you do it with a dated sample. A requirement with a beautiful policy and no practice behind it shows up as exactly that, and gets a next step telling you how to close the gap rather than a green check that flatters you.
Upload a policy on any topic and the system pulls out each promise it makes and marks it We do this, Sometimes, or We do not. Weak policies get rated and can be redrafted from what you really do. Topics no policy covers get a draft to start from. Records you are already generating, incidents, signed attestations, training completions, vendor agreements, feed in as proof automatically.
The parts practices actually get wrong
A few areas account for most of the trouble we see in the field, and they each got their own treatment.
Vendors and business associate agreements. Practices routinely cannot produce a list of who touches their patient data. ComplianceAX gives you a prompt list to find them, then works out whether a given vendor needs a BAA based on what the company does and what it can reach, rather than leaving you to guess. Signed agreements are tracked with expiry dates and confirmed every year.
Training. Everybody gets the basics. Pass-through roles like a cleaning service get a short notice instead of a full course. Each additional duty adds its own topics. Assignment and completion are tracked per person, which is what the regulation actually asks for.
Incidents. A guided case file opens with the 60-day breach notification clock visible the entire time, walks the four-factor assessment, and keeps every stage in the record. A person makes the breach determination. Always.
Everyone else’s part. Compliance fails when it is one person’s side project. Questions can be routed to the staff member or vendor who owns them, each person gets their own dashboard of tasks, training and policies to sign, and email reminders go out when it is their turn. You review everything that comes back before it counts.
If someone comes asking
One click builds a dated packet: answers, evidence, policies with their version history, training records, business associate agreements, incidents, and the audit log. You can build it as of any date you choose, which matters when the question is what you knew in March.
Every HIPAA obligation traces to the question that covers it and the document that supports it. Evidence is kept for six years with the date and the name of whoever added it.
We will help you gather and present it. That is support and organization, not legal representation, and we will not pretend otherwise.
What we will not claim
There is no such thing as HIPAA certification. The Department of Health and Human Services does not certify anyone, and no vendor can hand you a certificate that means anything. Any product that tells you it will make you HIPAA compliant is making a promise it has no standing to make.
ComplianceAX will not guarantee you a clean audit, and neither will we. What it will do is make sure the work is done, the evidence exists, and the record is organized and dated when you need it. In our experience that is most of the distance between a practice that handles an investigation and one that does not.
It does not stop being useful when you grow
Nothing about this is limited to a single-provider office. A practice in ComplianceAX is made of sites, and physical safeguard questions are answered per site, because the answer about who holds the keys to the server room is genuinely different at each location. Scores roll up per site and per section as well as for the practice as a whole, so a group can see which location is behind without reading eleven separate reports.
Responsibility splits the same way. Sections have owners, the Privacy Official and the Security Official own what belongs to them by default, and a site manager can be scoped to their own location and see nothing else. Everyone gets their own task list rather than one person holding the entire assessment.
There are no user caps. Not ten admins, not twenty-five employees. If you have ninety staff across six locations, all ninety get training records and policy signatures, because that is what the regulation asks for and charging per seat to meet it never made sense to us.
For the IT companies reading this
If you are a business associate rather than a practice, you have your own HIPAA obligations and most of you are thinner on them than your clients assume. ComplianceAX has a separate assessment built for business associates, covering what applies to you rather than making you skip past questions about exam rooms.
How to see it
The platform is in use now. A demo runs about 30 minutes and walks through the assessment, the document-based head start, and what a finished record looks like at the end.
If you want the broader picture of how we build private AI systems, our Local AI practice covers the hardware and the approach, and our HIPAA compliance services page covers the work we do alongside the software.
ComplianceAX
Take a look at it yourself.
See the assessment, the document-based head start and a finished record. A demo runs about 30 minutes and you can book it straight from the ComplianceAX site.
Or call Southeastern Technical at (678) 807-6156.
Frequently asked questions
Does ComplianceAX make my practice HIPAA compliant?
No software can do that, and any product that says otherwise is selling you something. There is no government HIPAA certification to earn. What ComplianceAX does is get the work done and documented: every requirement answered, every answer backed by evidence with a date and a name on it, and a packet you can hand to an investigator. Compliance is a judgment a person makes about your practice. We give you the record that judgment rests on.
Where does the AI run, and does it see patient data?
Every model runs privately on hardware we own and operate. Your documents are never sent to OpenAI, Google, Anthropic or any other public AI service. The AI also has a hard limit on what it is allowed to do: it may suggest an answer only when it can quote a sentence from your own document word for word, and software checks that quote against the source before anyone sees it. No quote, no suggestion.
How long does the assessment take?
Setup is about two minutes. The assessment itself runs 195 questions across 282 HIPAA requirements, and most practices do it in sittings of fifteen or twenty minutes rather than one long day. If you upload your existing policies first, the AI answers a large share of it before you start, so you spend your time reviewing rather than typing.
What happens if we have a breach?
ComplianceAX opens a guided case file with the 60-day notification clock visible on the screen, walks through the four-factor risk assessment HIPAA requires, and keeps every step in the record. The determination of whether something is a reportable breach is made by a person, never by the software.
Is this only for small practices?
No. A practice is made of sites, physical safeguard questions are answered per site, and scores roll up per site and per section as well as for the whole organization, so a multi-location group can see which location is behind. Sections have owners, and a site manager can be scoped to their own location. There are also no user caps, so a ninety-person practice across six locations gets training records and policy signatures for all ninety people.
Can our IT provider or billing company use it too?
Yes, and they should. Business associates have their own HIPAA obligations and get their own assessment in ComplianceAX. A practice can also send individual questions to a vendor to answer directly, then review the response before it counts.
What do we actually get at the end?
A dated audit packet built in one click: your answers, the evidence behind them, policies and their version history, training records, business associate agreements, incidents, and the full audit log. Evidence is kept for six years with the date and the person who added it.
Talk to Us About Your Practice
Tell us where your compliance or IT situation stands and we will get back to you. No obligation, and no sales sequence.