Skip to main content

HIPAA Compliance

CareLaunch processes protected health information (PHI) as a business associate of the healthcare organization using the service. PHI is governed by the Business Associate Agreement and by HIPAA. Where this page and the agreement differ, the agreement controls.

The agreement is accepted when the account is created. It stays available in the CareLaunch app at /baa.

Technical safeguards are described on the Security Overview. In short, the platform provides:

  • Encryption of stored data (AES-256) and of data in transit (TLS 1.2), in a cloud healthcare data store operated for HIPAA workloads.
  • Role-based access, optional multi-factor authentication, and lockout after repeated failed sign-ins.
  • Audit logs of access to personal and health information.
  • Network controls, including a web application firewall, and separation of the data store from other systems.

Those controls are what CareLaunch operates. They do not replace your own policies for who on your staff may see a record, or for how you use PHI in outreach.

GDPR​

If someone is in the European Union or the European Economic Area, the privacy policy states that CareLaunch aims to take reasonable steps to let them correct, amend, delete, or limit the use of personal data. This page is not a statement that every GDPR obligation is met automatically.

AI features​

Administrative AI features, including the AI Concierge, send the text you submit, recent messages in that conversation, and organization details needed to answer to OpenAI at https://api.openai.com. If the assistant runs an action, the information that action returns is sent as well. Personal information in the message is included.

CareLaunch has a Business Associate Agreement with OpenAI that covers this processing. Your organization's agreement with CareLaunch still governs the protected health information CareLaunch holds for you. Do not paste patient names, birth dates, record numbers, or other protected health information into the Concierge or other AI helpers. Information the assistant reads when it runs an action is sent too.

Patient-facing features that would send clinical information or patient messages to OpenAI stay off unless CareLaunch has turned them on.

Campaigns​

When a campaign can identify a patient:

  • Prefer a message that does not include PHI. If you do not need an identifier, leave it out.
  • The HIPAA Privacy Rule's de-identification standard removes 18 identifiers of the person and of relatives, household members, and employers.
  • Get the consent your privacy policy and the Privacy Rule require before you use PHI in outreach, and say why you are using it.
  • A vendor that creates, receives, maintains, or transmits PHI for you needs its own business associate agreement. Signing CareLaunch's agreement does not cover a tool you connect on your own.

If you suspect a violation​

Report it to your privacy officer. Confirm what happened, and notify affected people and the U.S. Department of Health and Human Services when the Breach Notification Rule requires it. Contact CareLaunch at support@carelaunch.health if the event involves the platform.