# HIPAA and health data

> If you sell health products or see patients, read this before importing customers.

Source: https://docs.dashfordevs.com/v1/privacy-and-security/hipaa · Topic: Privacy, security and HIPAA · Updated: 2026-11-07

If your business sells prescriptions, peptides or other health products, or books patients, the fact that a named person bought a product or booked a visit is **protected health information (PHI)**. [HIPAA](https://www.hhs.gov/hipaa/for-professionals/index.html) sets rules for how it is handled.

## Our side

-   DashForDevs has a **business associate agreement (BAA)** with [Amazon Web Services](https://aws.amazon.com/compliance/hipaa-compliance/), where the platform runs.
-   Customer data is treated as PHI everywhere: encrypted at rest, kept in the vault, accessed only by permission, and every access logged.
-   Payment processors and analytics never receive what a person bought.
-   **No third-party tool touches PHI without a BAA.** Features that would send customer details to a vendor that has not signed one (some email, SMS and AI features, some carrier label buying) are built but switched off for HIPAA organizations until that vendor signs.

## Your side

1.  **Tell us** your organization holds PHI, so it is marked as a HIPAA organization.
2.  **Sign a BAA with DashForDevs.** Contact us; it is part of onboarding.
3.  **Run your program** at **hipaa.dashfordevs.com**: a checklist of the safeguards HIPAA expects, with automatic checks that read your real settings (for example whether two-factor sign-in is required), and space for your evidence.
4.  **Keep PHI out of public content.** Blog posts, page groups and media are public content. Never put patient information in them.

**Not legal advice.** We give you the tools and do our part. Whether your business complies is between you, your advisors and HIPAA.