HIPAA and health data

If your business sells prescriptions, peptides or other health products, or books patients, the fact that a named person bought a product or booked a visit is protected health information (PHI). HIPAA sets rules for how it is handled.

#Our side

• DashForDevs has a business associate agreement (BAA) with Amazon Web Services, where the platform runs.
• Customer data is treated as PHI everywhere: encrypted at rest, kept in the vault, accessed only by permission, and every access logged.
• Payment processors and analytics never receive what a person bought.
• No third-party tool touches PHI without a BAA. Features that would send customer details to a vendor that has not signed one (some email, SMS and AI features, some carrier label buying) are built but switched off for HIPAA organizations until that vendor signs.

#Your side

1. Tell us your organization holds PHI, so it is marked as a HIPAA organization.
2. Sign a BAA with DashForDevs. Contact us; it is part of onboarding.
3. Run your program at hipaa.dashfordevs.com: a checklist of the safeguards HIPAA expects, with automatic checks that read your real settings (for example whether two-factor sign-in is required), and space for your evidence.
4. Keep PHI out of public content. Blog posts, page groups and media are public content. Never put patient information in them.