HIPAA Compliance
EasyMindCare operates as a business associate under HIPAA. This page describes the safeguards we implement to protect your clients' protected health information (PHI) — and where to read the agreement behind them.
Administrative Safeguards
- Signed Business Associate Agreement with every customer
- Signed BAAs with the third-party vendors that handle PHI on our behalf (SMS, email, hosting, storage)
- Access scoped to your practice — your records are visible only to you and the members you invite
- Incident response and breach notification procedures aligned with HIPAA
- Export window after cancellation so your records stay yours
Infrastructure & Physical
- Hosted on professional cloud infrastructure with provider-managed physical security
- File and attachment storage in encrypted private B2 object buckets
- Encrypted database backups, verified by a monthly restore drill
- Marketing analytics kept out of PHI-bearing applications
Technical Safeguards
- TLS/SSL encryption in transit and AES-256 encryption at rest
- Optional two-factor authentication (TOTP with backup codes)
- Role-based access controls scoped to your practice
- Audit logging of record access, changes, imports, exports, and sign-in events
- Automated penetration testing on a regular schedule; validated findings are tracked to remediation
- Session management: 30-day expiry, active session review and revocation, other sessions signed out on password change
Business Associate Agreement (BAA)
The contract that defines our HIPAA obligations to you
As a business associate under HIPAA, EasyMindCare is bound by a Business Associate Agreement that covers how we may use and disclose PHI, the safeguards we must maintain, and our breach notification duties. The BAA is incorporated into our Terms of Service and you agree to it when you create an account. You can read the full text any time — no request required.
Read the full BAAHow the safeguards work in practice
Encryption & Access Controls
Encryption
- • TLS/SSL for all data in transit
- • AES-256 encryption at rest
- • Encrypted private B2 buckets for file and attachment storage
- • Encrypted database backups
Access Controls
- • Two-factor authentication available for every account
- • Role-based permissions scoped to your practice
- • Audit log of record access, changes, imports, exports, and sign-in events
Breach Notification
If a security incident involving PHI occurs, our procedure follows the HIPAA standard:
- Immediate internal incident response and containment
- Notification to affected practices without unreasonable delay and no later than 60 days, as HIPAA requires
- Cooperation with your notifications to clients and regulators where required
- Full incident documentation for your records
Your HIPAA Responsibilities
Important Reminder
EasyMindCare provides a HIPAA-aligned platform, but you remain responsible for your own practice's compliance: staff training, client consent and notice forms, minimum-necessary use of records, and proper handling of PHI outside the platform. The interactive checklist tool is a good starting point.
Documentation & Resources
Everything below is public — no request required:
Business Associate Agreement
The full BAA covering our obligations as your business associate.
Privacy Policy
How we handle, protect, and limit use of your data.
Terms of Service
The agreement the BAA is incorporated into.
HIPAA Checklist Tool
Interactive checklist for the safeguards your own practice needs.
Questions about security or the BAA?
We answer security and compliance questions directly — including what you need to complete your own vendor due diligence.