HIPAA & Health Data

We'd rather give you an honest, specific answer than a vague or overstated one — this page exists specifically to be direct about where we stand.

Personal Health Inspector is not HIPAA certified

Personal Health Inspector is not currently HIPAA compliant or certified, and we do not claim otherwise. HIPAA (the Health Insurance Portability and Accountability Act) applies to "covered entities" — healthcare providers, health plans, and healthcare clearinghouses — and their "business associates." Personal Health Inspector is a personal organizational tool used directly by individuals and families; it is not, itself, a covered entity, and we have not undergone the independent technical, administrative, and legal review that a genuine HIPAA-compliance claim requires.

What that means in practice

The information you record — medications, appointments, notes — is protected by the account-level security described on our Security page (authentication, authorization, encryption of data in transit, and scoped database access). It is not, however, held under a HIPAA Business Associate Agreement, because we are not acting as a business associate to a covered entity for the accounts we serve directly.

If you're a healthcare organization

If you're a covered entity or business associate considering Personal Health Inspector for a use case that would require HIPAA compliance, please contact us before doing so — as of this writing, we don't offer a HIPAA-compliant deployment or a Business Associate Agreement, and this deployment isn't intended for that use case.

What we do instead

Rather than an unverified compliance claim, we focus on concrete, checkable practices: hashed passwords, signed and scoped session cookies, server-side authorization on every request, permission-scoped caregiver access, and a payment flow that never touches your card details directly. See our Security page and Privacy Policy for the specifics.

Not a substitute for medical care

Regardless of compliance status, Personal Health Inspector is an organizational tool, not a healthcare provider. It does not diagnose, treat, or prevent any condition, and it is not an emergency service — call your local emergency number for a medical emergency.