HIPAA and health data

When HIPAA applies

HIPAA applies to covered entities — most healthcare providers and health plans — and to their business associates. A direct-to-consumer wellness app is not automatically covered.

When you use NurturaCare through a clinic, hospital or health plan, we act as that organisation’s business associate for the protected health information we handle on their behalf. A business associate agreement is signed with the organisation, and with every vendor that can reach that information, before such a deployment goes live.

When you sign up directly as a consumer, HIPAA generally does not apply to your account — but the FTC Health Breach Notification Rule may, and our security and privacy commitments apply to you identically.

What that means in practice

We built the architecture so a HIPAA-regulated deployment is a configuration, not a rewrite.

• Encryption in transit and at rest, with field-level encryption for free-text health data.
• Role-based access control, least privilege, and mandatory MFA for staff accounts.
• An append-only audit trail of every change to member data, every sign-in and every shared record opened, protected by a database trigger.
• Row-level security enforcing organisation isolation at the database, not only in application code.
• Incident response, breach investigation and notification procedures, and business associate agreements with every vendor that can reach protected health information, completed as conditions of the first regulated deployment.

Breach notification

Consumer accounts are covered by the FTC Health Breach Notification Rule from the day they are opened, and we notify affected members and the FTC as that rule requires. For organisations deploying under HIPAA, the incident classification, investigation, notification and evidence-retention procedures the rule requires are put in place, with named owners, before the deployment goes live.

This is not legal advice

This page describes our engineering and operational posture. Whether HIPAA applies to a specific deployment is a legal determination made with counsel.