Trust · United States

HIPAA: programme in progress.

MedAppz is hosted in the United States, and that is not HIPAA compliance. A covered entity may only share protected health information with a vendor that signs a business associate agreement (BAA), and every vendor behind that one needs a BAA too. None of ours are signed yet. This page says what the product already does, what is still open, and what you would need to do.

Send us your HIPAA questions The trust centre

Status as of 24 September 2026
No compliance claimed
Every control names its module

At a glance

Law: HIPAA (the US Health Insurance Portability and Accountability Act)
Region: MedAppz United States
Data stored in: Boston, United States · Hostinger VPS
What we hold: Programme in progress
Our items in place: 1 of 9
Status as of: 24 September 2026

Status

Where we stand, as of 24 September 2026

This covers HIPAA (the US Health Insurance Portability and Accountability Act). MedAppz does not claim compliance with it or any certification under it. This is a programme in progress, and this table is where it stands. Records are stored on one server: Boston, United States · Hostinger VPS. It is a US location, but a US server is not a HIPAA-covered arrangement without a BAA.

Item	Status	Note (2026-09-24)
Business associate agreement from MedAppz to you	Not started	We will not offer one until the vendors below have signed theirs.
BAA with our host (Hostinger)	In progress	We have asked whether Hostinger signs a BAA for this VPS. Unconfirmed. If it does not, US patient data moves to a host that does.
BAAs with AI and speech-to-text vendors	Not started	None signed. You can switch AI and transcription off for your organisation today.
BAAs with SMS, email and WhatsApp providers	Not started	None signed. Our SMS provider today is an Indian gateway, and US text messaging is not set up.
Written HIPAA risk analysis	Not started	Not yet done or published.
Breach notification workflow for HIPAA timelines	Not started	The breach register tracks Indian notice deadlines (CERT-In and the Data Protection Board). HIPAA’s are not built in yet.
Audit trail, emergency access, access reviews, backups	In place	Listed below, each with the module that does it.
Encryption at rest for the database and backups	In progress	Backup encryption is built but not yet switched on. Backups are not yet held off-site.
HIPAAGuard (a HIPAA workflow app)	In progress	In development; see its catalog page.

In place

In place in the product today

Each of these runs in the product now. The line under each one names the part of the law it relates to. That is a pointer for your own review, not a claim that the clause is met.

An audit trail that cannot be editedRecord opens, searches and exports are written once: who, when, from where, under which permission. The log is append-only by database trigger and hash-chained day by day; the chain is re-verified nightly.Audit schema and AuditLens · Audit controls — §164.312(b)

One clinic cannot read another’s rowsRow-level security on every tenant table, bound to the transaction. The account the application runs as cannot switch it off.Database row-level security · Access control — §164.312(a)(1)

Emergency access that expires and is reviewedBreak-glass access needs a written reason, lasts at most four hours (a database constraint), and lands on a review queue.BreakGlass · Emergency access procedure — §164.312(a)(2)(ii)

Consent records, by notice versionMessages are gated on the consent notice the patient accepted, by version, at the moment of sending. Withdrawal cancels what is queued.ConsentVault and the consent service

Access reviews with two-person revocationThe Security Centre runs dated access-review campaigns over privileged grants (full patient data, money, platform, emergency access). A challenge raises a two-person approval; a campaign cannot close with unread items.Security Centre · Information system activity review — §164.308(a)(1)(ii)(D)

Strong sign-in and short sessionsArgon2id password hashing, lockout after five failures, optional or organisation-required app-based two-factor, 15-minute access tokens with rotating refresh tokens, and a five-minute idle-out on shared devices.Identity · Person or entity authentication, automatic logoff — §164.312(d), (a)(2)(iii)

Encryption in transit, and sealed credentialsTLS on every connection, with certificates renewed automatically. Keys and passwords a clinic gives us are sealed with AES-256-GCM, bound to the organisation, and never shown back.TLS and the secrets envelope · Transmission security — §164.312(e)(1)

Nightly verified backups, with a rehearsed restoreThe database and files are dumped every night and each dump is checked before the run counts as a success. A full restore was rehearsed on 3 September 2026.ops/backup.sh · Data backup plan — §164.308(a)(7)(ii)(A)

Exports are whitelisted and recordedOnly listed views can be exported, each needs its permission, and each export is recorded with its row count and data classes.Exports

AI you can switch off, or send redactedOne setting per organisation: off, redacted (the default) or full. Redacted strips the name, date of birth, hospital number, phone and email before the request leaves our server. A named person accepts every draft.AI governance

Your side

What you would need to do

Do not put real patient data into MedAppz until a BAA is signed between you and us, and ours with our vendors are in place. The demo clinic has invented data for trying the product.
Do your own risk analysis. HIPAA puts it on the covered entity, whoever the vendor is.
Turn AI and transcription off, or keep them on redacted, until the AI vendors have signed BAAs.
Require two-factor sign-in for everybody in your organisation (it is one setting).
Keep your own policies: workforce training, sanctions, device and media controls. Software cannot do these for you.

This page describes our product. It is not legal advice; take your own advice on how the law applies to your practice.

Sub-processors

Sub-processors and where they are

Every outside service the product can send data to, where it processes it, and whether an agreement is signed. The list is generated from the register the product itself reads, the same one the Trust Centre shows.

The Trust Centre’s list →

Service	Location	Agreement
Hostinger — The rented server the database, the application and the uploaded files run on	One rented region	None signed yet
S3-compatible object storage — Where uploaded files and documents live when object storage is switched on	The bucket region the deployment configured	None signed yet
Anthropic — AI drafting and answering	United States	None signed yet
OpenAI — AI drafting and answering	United States	None signed yet
Google (Gemini) — AI drafting and answering	United States	None signed yet
NVIDIA NIM — AI drafting and answering	United States	None signed yet
The configured speech-to-text service — Turning a consultation recording into a transcript	Wherever SPEECH_API_BASE_URL points — api.openai.com (United States) unless changed	None signed yet
The clinic’s own Jitsi server — Carrying the live audio and video of a video visit	Wherever the clinic hosts it	None signed yet
Resend — Sending email	United States / European Union	None signed yet
MSG91 — Sending SMS	India	None signed yet
Meta (WhatsApp Business) — Sending WhatsApp messages through the official API	Meta’s global network	None signed yet
The clinic’s paired WhatsApp number — Sending WhatsApp messages from the clinic’s own handset session	Meta’s global network, through the clinic’s own number	None signed yet
The common WhatsApp assistant number — Staff asking the assistant from their own WhatsApp, and patients who write to the common number	Meta’s global network, through the platform’s paired number	None signed yet
Google (Firebase Cloud Messaging) — Delivering push notifications to a phone	Google’s global network	None signed yet
Razorpay — Taking a payment online, and holding a standing UPI Autopay or e-mandate authorisation	India	None signed yet
PhonePe — Taking a payment online	India	None signed yet
Stripe — Taking a payment online	United States	None signed yet
Pine Labs — Taking a card payment on the counter terminal	India	None signed yet
Google Sheets — Receiving a scheduled export	Google’s global network	None signed yet
Google Business Profile and Meta — Reading reviews and publishing the clinic’s replies	Google and Meta’s global networks	None signed yet
The clinic’s own mail server — The mailbox MedAppz proxies rather than copies	Wherever the clinic’s mail is hosted	None signed yet
The hospital’s own GST Suvidha Provider — Registering the hospital’s own patient invoices with the Invoice Registration Portal	India	None signed yet
The clinic’s own Tally server — Receiving the accounting export, and answering which vouchers it took	Wherever the clinic runs Tally	None signed yet
National Health Authority (ABDM gateway) — India’s national health exchange: linking care contexts and sending records a patient consented to	India (NHA)	None signed yet
A database the clinic brings — A destination the clinic asked the product to write to	Wherever the clinic hosts it	None signed yet

Questions

HIPAA, briefly

Where does MedAppz stand on HIPAA today?

MedAppz does not claim compliance with HIPAA or any certification under it. As of 24 September 2026, 1 of the 9 items on our side are in place and 8 are still open; the table above lists each one.

Where are the records stored?

Records are stored on one server: Boston, United States · Hostinger VPS. It is a US location, but a US server is not a HIPAA-covered arrangement without a BAA.

What would our practice need to do?

Do not put real patient data into MedAppz until a BAA is signed between you and us, and ours with our vendors are in place. The demo clinic has invented data for trying the product. Do your own risk analysis. HIPAA puts it on the covered entity, whoever the vendor is. Turn AI and transcription off, or keep them on redacted, until the AI vendors have signed BAAs. Require two-factor sign-in for everybody in your organisation (it is one setting). Keep your own policies: workforce training, sanctions, device and media controls. Software cannot do these for you.

Send us your HIPAA questions

Your security questionnaire is longer than this page. Leave a number and we will answer it line by line, including where the answer is “not yet”.