Remote desktop, built for clinical data.

Most “HIPAA-compliant” remote desktops relay your session through their cloud.

Look at the wire diagram of the popular incumbents. A client connects to the vendor's cloud. The host workstation connects to the same vendor's cloud. The vendor forwards frames, keystrokes, clipboard, and file transfers between the two endpoints — which means every byte of clinical data passes through infrastructure the vendor operates, monitors, and (legally speaking) handles. The vendor becomes a business associate because the vendor is, in fact, an associate handling your business.

A BAA in that posture is not optional — it is mandatory, because the vendor's servers see PHI in transit and could, in principle, decrypt it (if they hold the session keys) or be compelled to retain it. Every subcontractor that touches the vendor's stack — their cloud provider, their content-delivery partner, their analytics platform — inherits some portion of that exposure under chained BAA structures.

Remio's infrastructure never sees a frame of your screen.

Remio uses a different topology. The signaling server — the only piece of Remio infrastructure your devices contact — is the smallest possible introduction service. It tells the host and the client how to find each other on the network, then steps out of the path. From that moment on, the connection is direct between the two devices, end-to-end encrypted with keys derived on the endpoints. Pixels, keystrokes, audio, clipboard, file transfers, recordings — nothing reaches Remio.

If a court order arrived tomorrow demanding session data, Remio would have nothing to produce. If Remio's signaling server were breached, the attacker would find no PHI to exfiltrate — just a list of devices that, at some point, exchanged a handshake. There is no honeypot to point an adversary at, because the honeypot does not exist.

A vendor checkmark is a deployment claim; an architecture is a structural property.

When a vendor says “we are HIPAA compliant”, what they typically mean is: “we have signed BAAs with our subcontractors, we have administrative policies in place, our SOC 2 audit covers the relevant controls.” That can all be true and still leave clinical data flowing through third-party infrastructure that you do not control and cannot audit at the wire level.

Remio's posture flips the question: instead of asking how well a vendor protects your data while they hold it, ask whether the vendor needs to hold it at all. The answer for Remio is no. End-to-end encryption with direct peer-to-peer transport is not a feature we added on top — it is the only mode the product ships in.

Remio's role is to ship software that runs on your hardware.

There is a meaningful difference between a vendor that hosts a service handling your PHI (a service provider) and a vendor that ships software that runs on your hardware and never sees the data (a software supplier). Remio falls firmly in the second category. The host application runs on your workstation; the client application runs on your clinician's device; the encryption keys exist only on those two endpoints; the session never enters Remio infrastructure.

Under HIPAA, a software supplier whose product never touches PHI is not automatically a business associate. The conduit exception and related guidance reflect a similar principle for vendors that have only ephemeral access to data they cannot decrypt. Remio's signaling, when it operates at all, is closer to a conduit handshake than a service that processes PHI.

Encryption in transit, encryption at rest, and access controls are protocol-level.

HIPAA's technical safeguards (45 CFR § 164.312) require encryption of electronic PHI in transit and at rest where reasonable, access controls that uniquely identify users, and audit-grade logging where applicable. Remio's protocol is designed around those obligations. The streaming transport is AES-256 with per-session ephemeral keys — the same family of encryption that protects banking sessions and government traffic. Host-side recordings, when enabled, write to encrypted local storage. Pairing uses a per-device PIN that authorises a specific device, not an identity, and can be revoked instantly.

Because these safeguards live in the protocol itself rather than in an operational policy that a vendor promises to follow, they cannot be silently relaxed by an internal decision or a configuration drift. The product cannot fall back to an unencrypted transport. There is no “convenience mode” that bypasses end-to-end encryption.

A small BAA scope means fewer chained obligations to manage.

When a vendor's BAA scope is broad — the vendor hosts the service, stores the data, processes the data with subcontractors — your procurement team has to chase every downstream BAA, audit every subprocessor, and re-evaluate every vendor-side architectural change. Remio's narrow scope removes most of that work, because there is little downstream activity to chase.

Will Remio sign a BAA? Yes — on request, and the scope reflects the architecture. Customers conducting their own HIPAA validation typically find Remio adds less risk than a cloud-relayed alternative, because the data-flow surface that the BAA has to govern is structurally minimised.

Complete a HIPAA risk analysis for the workflow you are deploying.

HIPAA expects covered entities and business associates to perform their own documented risk analysis for each workflow that touches PHI. No vendor — including Remio — can do this on your behalf, because only you know the full inventory of data, devices, and people involved. Treat this page as supporting evidence about the Remio component; do not treat it as a substitute for the analysis itself.

Confirm full-disk encryption and screen-lock policy on every endpoint.

End-to-end encryption protects the session in transit. It does not protect a workstation whose disk is unencrypted and whose screen does not lock. Verify FileVault is enabled on every Mac, BitLocker on every Windows endpoint, and a comparable disk-encryption mode on iOS and Android devices participating in the workflow. Confirm idle screen-lock timeouts that match your institution's policy.

Document a workforce training programme on the workflow.

HIPAA's administrative safeguards require that workforce members be trained on the policies and procedures that govern their handling of PHI — including remote access. Document who is trained, on what, and when refreshers occur. The strongest technical safeguards will not survive a clinician who shares a pairing PIN over an unsecured channel; training is the layer that prevents that.

Sign appropriate BAA structures with any other vendor that touches PHI in your stack.

Remio's BAA scope is narrow because Remio's architecture is narrow. But your stack almost certainly includes other vendors — an EHR provider, a cloud storage tier, a backup service, an identity provider — that do touch PHI. Make sure each of them has a signed, current BAA with appropriate scope. Remio's posture removes one set of vendor risks; it does not remove the others.

Have a written incident-response plan that covers remote-access compromise.

Even with strong technical safeguards, plan for the day a clinician's laptop is stolen or a pairing PIN is leaked. Document who revokes the pairing, how the affected sessions are reviewed, and what disclosure obligations apply under your state's breach-notification rules. Test the plan annually. The institutions that handle incidents well are the ones that practised before the incident.