PsychSuite provides critical infrastructure for clinical practices. Protecting the confidentiality, integrity, and availability of Protected Health Information (PHI) is a fundamental part of our operations.
1. Our Role as a Business Associate
Under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), clinics and healthcare providers act as Covered Entities. Because PsychSuite stores, processes, and transmits PHI on behalf of these providers, we act as a Business Associate. We embrace our legal and ethical obligations under HIPAA and the HITECH Act to keep patient data secure.
2. What a BAA Covers
Our standard Business Associate Agreement (BAA) establishes a legally binding contract that dictates how we handle your PHI. Key provisions include:
- Permitted Uses and Disclosures: We will only use or disclose PHI as permitted by the BAA or required by law.
- Safeguards: Our commitment to implement appropriate administrative, physical, and technical safeguards.
- Subcontractor Flow-Down: Ensuring that any subcontractors creating, receiving, or maintaining PHI agree to the same restrictions.
- Return or Destruction: Guidelines for securely returning or destroying PHI upon termination of the agreement.
3. Requesting a BAA
A BAA must be executed before any PHI is uploaded or transmitted to the PsychSuite platform. During the onboarding process, your account representative will provide our standard BAA for signature. If you need a copy for review, please contact support@psychsuite.com.
4. Administrative, Physical, and Technical Safeguards
We implement robust safeguards to protect PHI, including:
- Technical: AES-256 data-at-rest encryption, TLS 1.2+ transit encryption, role-based access control (RBAC), multi-factor authentication (MFA), and comprehensive audit logging.
- Physical: We utilize world-class cloud infrastructure partners (e.g., AWS, Azure) who employ state-of-the-art physical security controls for their data centers.
- Administrative: Designated security officers, documented incident response plans, routine risk assessments, and vulnerability scanning.
5. Minimum Necessary and Access Management
We adhere to the "minimum necessary" principle. Our support and engineering teams are restricted from accessing PHI unless explicitly necessary for troubleshooting or system operations, and only when authorized by the Covered Entity.
6. Workforce Training
All PsychSuite employees and contractors undergo comprehensive HIPAA privacy and security training upon hire, followed by mandatory annual recertification.
7. Subcontractors and Subprocessors
We carefully vet third-party vendors that provide services to our platform. Any vendor that may access or process PHI must sign a downstream BAA with us. You can review our current list of vendors on our Subprocessors page.
8. Breach Notification
In accordance with the HIPAA Breach Notification Rule, if we discover a potential security incident or breach of unsecured PHI, we will notify the affected Covered Entity without unreasonable delay, facilitating their ability to notify patients and the HHS as required by law.
9. What HIPAA Does Not Cover Here
Data collected solely for B2B marketing purposes (like requesting a demo via this website) is not PHI and is not governed by the BAA. Such data is handled according to our standard Privacy Policy.
10. Patients
If you are a patient of a clinic using our software, HIPAA grants you rights regarding your medical records. Because PsychSuite is a technology vendor, we cannot process patient requests directly. Please review our Notice for Patients and contact your healthcare provider directly to exercise your rights.
11. Contact our Privacy Officer
For questions regarding our HIPAA compliance, security practices, or BAA execution, please contact our Privacy Officer at support@psychsuite.com.