How we protect patient data in every system we build.
Clinics trust us with systems that can touch protected health information. Here is what we sign, where the data lives, who can see it, and what we test before anything goes live.
Who this page is for
- Clinic owners deciding whether a technology partner can be trusted with patient data
- Practice managers and compliance leads who want straight answers before signing anything
- Practices that had a compliance scare and want the basics done properly
- Behavioral health and substance use programs with 42 CFR Part 2 records
- Anyone comparing vendors and asking how each one handles PHI
Five questions to ask any technology partner, answered.
You should get the same plain answers from every vendor. Here are ours.
Will you sign a Business Associate Agreement?
Yes. We sign a Business Associate Agreement before we access any PHI, and we handle it only as that agreement and the law allow.
Where does our data actually live?
In your own cloud environment (AWS, Azure, or Google Cloud), in accounts you own. We build there, and you keep the code, the designs, and the infrastructure.
Who can see patient data?
Only people who need it, with granular access controls, audit logging on anything that touches patient data, and multi-factor authentication on our own accounts. Healthcare work is done by our in-house, vetted team. We never outsource it.
How is the data protected?
Encryption at rest and in transit, access controls, and audit logging are part of every system from the first line of code. Where substance use records are involved, we add 42 CFR Part 2 consent tracking.
What do you test before real patient data is used?
A security check covers access controls, encryption, and backups against HIPAA and HITECH before anything touches real patient data. Demos and testing use synthetic data, never a real client's or patient's.
HIPAA, HITECH, and 42 CFR Part 2: what each one covers
Three rules shape most of our work. Knowing what each one does makes every vendor conversation easier.
- HIPAA sets the rules for protecting patient health information.
- HITECH added breach notification requirements and stronger enforcement for electronic health information.
- 42 CFR Part 2 adds stricter consent rules for substance use disorder treatment records.
- We describe our work as HIPAA and HITECH-aligned. That means we design and build to these rules. It is not a government certification, and your practice stays responsible for its own compliance.
- Our website and email are not for patient information. If any arrives, we do not use it, and we remove it. See our Privacy Policy.
- Want a quick look at your own website? Try our free HIPAA website check.
Security and compliance FAQ
Didn't answer yours? Ask us directly. The form is right below.
There is no official government HIPAA certification for vendors. We describe our work as HIPAA and HITECH-aligned: we build to the rules, sign Business Associate Agreements, and test before go-live. Your practice remains responsible for its own compliance.
If the vendor creates, receives, stores, or transmits protected health information for your practice, yes. A marketing website with no patient data may not need one, but a booking form, patient portal, or anything that collects health details usually does. When in doubt, ask your compliance adviser. Our guide explains what a business associate agreement is and who needs one.
It can be. If a form collects information about a patient's health or care, it may involve protected health information, and the tools that handle it need the right safeguards and agreements. We design forms to collect only what is needed to schedule or reach the patient, and we keep clinical details out.
In your own cloud accounts (AWS, Azure, or Google Cloud), owned by you. We build inside your environment, so the code, the designs, and the infrastructure stay yours.
Breach notification duties for PHI are set out in the Business Associate Agreement and in the law. Audit logging on the systems we build helps show what happened and who was affected, and we agree the notification process with you in writing before any PHI is involved.
No. Healthcare work is done by our in-house, vetted team. We do not outsource it.
Yes. For practices that keep substance use disorder records, we build consent tracking and access rules into the system so records are shared only as patient consent allows. Whether Part 2 applies to your program is a question for your compliance adviser. See also our page for behavioral health practices.
Have a security or compliance question? Ask us directly.
One email or a 30-minute call. We will answer plainly, including when the honest answer is that you need your lawyer.
We'll get back to you within one business day.
Prefer email? hello@atlantixlabs.comPlease don't send patient information by email.