HIPAA and healthcare data
Last Updated: September 11, 2026
Purechart AI LLC protects sensitive information under its security, access control, and data retention policies. Handling of protected health information (PHI) is also governed by applicable law and the relevant Business Associate Agreement (BAA).
1. Business Associate Agreement
When Purechart processes PHI on behalf of a Covered Entity, it acts as a Business Associate. Permitted uses and disclosures, safeguarding obligations, notifications, and data return or destruction are governed by the BAA and applicable law. To request a BAA, contact privacy@purechart.com.
2. Data protection and access
Our policies require access based on roles, least privilege, and legitimate business needs. They include appropriate authentication, MFA for critical systems and sensitive environments where applicable, periodic permission reviews, and prompt access revocation or modification. Communications use encrypted connections, including TLS 1.2 or higher where applicable; sensitive data stored in supported systems is protected with appropriate encryption mechanisms.
3. Monitoring and incident response
Security-relevant activity is logged and monitored where technically feasible. Suspected incidents are assessed, contained, investigated, remediated, and documented. Notifications follow applicable legal, regulatory, and contractual requirements. Report concerns to security@purechart.com.
4. Retention and disposal
Patient and healthcare records are retained in accordance with applicable healthcare and legal record-retention requirements. Secure disposal occurs at the end of the required retention period using methods appropriate to data sensitivity. Information subject to a legal hold, investigation, audit, or litigation is preserved until the requirement is released. Third-party providers follow documented procedures under applicable agreements and requirements.
5. Your organization’s responsibilities
Your organization is responsible for configuring appropriate permissions, protecting devices and credentials, training its workforce, obtaining required notices and consents, and meeting the obligations applicable to its use of the service. Consult the BAA and Terms of Use for each party’s responsibilities.