Question 1

Is Heidi HIPAA compliant?

Accepted Answer

Absolutely, Heidi is compliant with the Health Insurance Portability and Accountability Act (HIPAA) in the United States. Our commitment to HIPAA underscores our dedication to maintaining the highest standards of privacy and trust within the healthcare industry. We use a continuous compliance management system that makes sure we are always vigilant for our HIPAA compliance, instead of a point in time audit which can lead to vulnerabilities in between audits. We implement administrative, physical, and technical safeguards to protect the confidentiality, integrity, and availability of the personal health information (PHI) Heidi handles.

Question 2

How does Heidi comply with HIPAA?

Accepted Answer

Heidi complies with HIPAA through enterprise-grade security controls, privacy safeguards and customer contracting, including a Business Associate Agreement (BAA) when applicable. Heidi also adheres to international healthcare privacy standards and maintains certifications including SOC 2 and ISO 27001. This means high-level compliance and trustworthiness, especially for clinicians interested in exploring Heidi and its benefits.

Question 3

Are Heidi’s third-party subcontractors covered under BAAs?

Accepted Answer

Yes, where they handle protected health information (PHI). Subcontractors that create, receive, maintain, or transmit PHI on Heidi's behalf are bound by Business Associate Agreements (BAAs) that flow HIPAA obligations through to them. Subprocessors that don't handle PHI (payment processors, identity providers, and similar) are covered by Data Processing Agreements (DPAs) with zero-retention obligations: they must delete customer data immediately upon completing a specific task, and they are prohibited from storing, reusing, or training models on it. A current subprocessor list is available from compliance@heidihealth.com on request.

Question 4

Does Heidi adapt to stricter state-level privacy laws?

Accepted Answer

Yes. HIPAA establishes the federal baseline for PHI in the United States. Several states have layered stricter requirements on top, e.g., California's Consumer Privacy Rights Act (CPRA), Washington's My Health My Data Act, Nevada's SB 370, and Colorado's Privacy Act. Each expands the scope of regulated health data and add specific obligations around consent, disclosure, retention, and deletion.

Heidi supports compliance with those stricter frameworks: US data is hosted locally, audio is never retained, transcript and note retention is configurable per organization, data is pseudonymized before processing, and we sign BAAs with covered entities. Where a state's requirements call for further configuration, our compliance team works directly with customers to apply them.

Question 5

How does Heidi support specialty-specific documentation needs while maintaining compliance?

Accepted Answer

Heidi allows creation of customized templates with predefined sections and compliance checks tailored to specialty workflows. The platform's Document templates and Note templates can be adapted for different specialties while maintaining comprehensive compliance with HIPAA, NHS, GDPR, ISO 27001, SOC 2 Type II, PIPEDA, and APP standards.

Ask AI about Heidi:

Ask AI about Heidi:

HIPAA

Secure your customers’ ePHI data

Privacy and Security Safeguards

Risk Analysis and Management:

Training and Awareness

Business Associate Agreements (BAAs)

Incident Response and Reporting

Access Controls

Locally hosted data