How your agency's data is handled
Each part is a term of the agreements every agency signs; the page linked under it says more.
Our commitment
ABARecords works for an agency only after its HIPAA Business Associate Agreement is signed.
- Your agency's information is encrypted and kept in your agency's own database.
- No one at ABARecords sees it without your agency's written permission.
- Your data belongs to your agency, and only to your agency, forever.
01
Nothing before the Business Associate Agreement
An agency changes nothing in ABARecords until its authorized signer signs its agreements, the HIPAA Business Associate Agreement among them, and ABARecords countersigns them.
HIPAA & Data Agreements →02
Where the data lives
In the United States only. The agency's clinical and personnel records are kept in the agency's own database, in a cloud account the agency owns, under its own agreement with that provider. ABARecords' account holds only what the platform needs to run, and no information about a client.
Privacy Policy →03
Who can see it
The agency's own users, according to their roles. ABARecords' staff have no access because of their job; they see an agency's data only with a written, time-limited grant from the agency's director, for a stated purpose.
Terms of Service →04
How it is protected
Encryption in transit (TLS 1.2 or later) and at rest, two-step sign-in, audit logs the agency can review, and signed records sealed so they cannot be changed.
Privacy Policy →05
AI, only in your own AWS account
AI that reads your agency's information runs only on Amazon Bedrock in your agency's own AWS account, under your agency's own AWS Business Associate Addendum and with its written approval. ABARecords holds no AI key.
HIPAA & Data Agreements →06
What ABARecords never does
It never sells data, never uses it for advertising, never contacts an agency's clients, never shares one agency's information with another, and never uses it to train AI models.
How We Use Data →07
When an agency leaves
It keeps read-only access for 90 days to export everything; then its data is returned or destroyed, as the Business Associate Agreement provides.
Terms of Service →08
Code, keys and passwords
GitHub receives source code only: no agency data, no real person's details, no keys and no passwords. Demonstrations and tests use made-up people and the example NPI that CMS publishes, and the code is checked for anything else. Keys and passwords are typed by their owner on their own page, stored encrypted and never shown again; ABARecords never asks for them by chat or email.
HIPAA & Data Agreements →
