A business associate agreement, always
Under HIPAA, your practice is a covered entity and StackFloss is a business associate. We sign a BAA with every practice before we touch a single record.
HIPAA compliance
Your patients' data, protected at every step.
Patient records become protected health information the moment they leave your system. We built StackFloss around that fact, before we built anything else.
Our commitments
What we promise every practice.
Every vendor covered, too
Any service that handles patient data on our behalf, including the AI provider behind PracticeChat, signs a business associate agreement with us. No exceptions.
Read-only by default
We read your records to find what's been missed. Nothing changes in your system unless you turn on a specific task and approve it.
Never used to train AI
Your patients' information is used to serve your practice. It is never sold, and never used to train AI models.
Safeguards
How we protect patient data.
HIPAA's Security Rule asks for three kinds of safeguards. Here's how we meet each one.
Administrative
- Written security policies and regular risk assessments
- Staff trained on HIPAA before they access any data
- Access granted only to those who need it, only for as long as they need it
Technical
- Encryption in transit and at rest
- Every access to patient data logged and auditable
- Only the minimum data needed for each task
- Patient names masked to first name and last initial by default, and every unmask logged
- Multi-factor sign-in, and an automatic lock after 15 minutes idle
- Roles for each person: practice admin, standard user or read-only auditor
Physical
- Hosted in secure, access-controlled data centers
- No patient data stored on personal devices
- Data deleted when you leave, on your request
Always a person
What never happens without a human.
Automation is earned task by task, and some things always stay with your team.
- Every clinical decision
- Conversations with upset or frustrated patients
- Unusual or high-value account balances
- Anything that cancels a future appointment
- Patients with major treatment coming up
- Any change you haven't approved in advance
Questions
HIPAA, in plain terms.
Who is responsible for what?
Your practice is the covered entity: you own the patient relationship and the records. StackFloss is your business associate: we handle patient data only to provide our service, under a signed BAA that spells out exactly how.
Does PracticeChat send patient data to an AI company?
PracticeChat uses an AI provider to understand your questions and answer them. That provider is bound by a business associate agreement with us, and patient data is never used to train its models.
What happens if something goes wrong?
HIPAA requires a business associate to report a breach to the covered entity without unreasonable delay, and no later than 60 days after discovery. We commit to telling you as quickly as we can and helping you with whatever comes next. (HHS: Breach Notification Rule)
What happens to our data if we cancel?
We return or delete it, as your BAA specifies. You'll get written confirmation when it's done.
Can we review your BAA before signing up?
Yes. Ask us for it any time. We'd rather you read it before your diagnosis than after.
Questions about your practice's data?
Talk to us before you connect anything. We'll walk you through exactly how it works.