HIPAA Compliance
TherapOT takes the protection of health data seriously. This page describes how we approach compliance with the Health Insurance Portability and Accountability Act (HIPAA).
Our Commitment
TherapOT is committed to protecting the privacy and security of health information. We design our systems and processes with HIPAA requirements in mind and continuously work to strengthen our data protection practices.
Data Protection Measures
We implement administrative, technical, and physical safeguards including encrypted data storage, secure HTTPS transmission, access controls, password hashing with bcrypt, and regular security reviews.
Protected Health Information
Student data entered into TherapOT may constitute Protected Health Information (PHI). We treat all clinical documentation, student profiles, and therapy session records with the highest level of care and restrict access to authorized users only.
User Responsibilities
As a TherapOT user, you are responsible for ensuring that your use of the platform complies with your institution's HIPAA policies. This includes using strong passwords, logging out of shared devices, and only entering data you are authorized to document.
Business Associate Agreements
If your organization requires a Business Associate Agreement (BAA) to use TherapOT, please contact us at hello@therapot.com. We are prepared to enter into BAAs with covered entities as required by HIPAA.
Incident Response
In the event of a data breach or security incident, we will notify affected users and relevant authorities in accordance with HIPAA breach notification requirements. We maintain an incident response plan and conduct regular drills.
Contact
For questions about our HIPAA compliance practices or to request a BAA, contact us at hello@therapot.com.
Disclaimer: This page provides general information about our approach to HIPAA compliance. It does not constitute legal advice. Users should consult their own compliance officers and legal counsel to ensure their use of TherapOT meets their organization's specific regulatory requirements.