Security & HIPAA

HIPAA security designed around your BAA.

A per-organization executed Business Associate Agreement, server-side AI proxying, SSO with Google and Microsoft, and contractual commitments — including a 10-business-day breach-notification window — that hold up to procurement review.

What you see below is not a marketing summary. Every commitment links to the clause that backs it.

The Four Things Your IT Team Will Ask About
BAA

Executed BAA, per organization

Every customer signs a BAA with UPStandards LLC before using the platform with real PHI. Audit trail, both parties' signatures, downloadable anytime.

AI

PHI is contractually walled off from AI

The BAA prohibits transmitting PHI to Anthropic or any non-BAA vendor. AI runs through a server-side proxy on aggregate or de-identified inputs only.

Auth

SSO and email sign-in

Google, Microsoft (Entra ID / Azure AD), or email and password. Self-service password reset. Role-based access for org admins, billing admins, and clinical roles.

Lifecycle

Your data, your export

Customer Data is available for export throughout your subscription and for 30 days after termination — longer on enterprise terms.

The Business Associate Agreement

A real, executed BAA — not a "contact us for one."

When you sign up, you're not joining a platform that "supports HIPAA." You're entering into a contractual relationship governed by an executed Business Associate Agreement under HIPAA's Privacy, Security, Breach Notification, and Enforcement Rules.

The BAA is signed before your organization uses the Services with real PHI. The signed copy lives in your account, with a complete audit trail — both parties' names and titles, signature (drawn or typed), the version of the BAA you accepted, the signing IP address, and the timestamp. You can open it, print it, or download it anytime from the Your Business Associate Agreement page inside the app.

Under Section 5 of the BAA, UPStandards shall not transmit PHI to Anthropic, external AI providers, or other non-BAA vendors unless the parties amend the Services architecture and contractual terms. That is not a policy statement — it is a contract.

Under Section 6, UPStandards implements administrative, physical, and technical safeguards including workforce confidentiality obligations, access controls, role-based permissions, authentication, encryption in transit, encryption at rest where supported by infrastructure providers, logging, backup and recovery, vendor review, vulnerability management, and incident response.

Under Section 7.1, in the event of a Breach of Unsecured PHI, UPStandards reports to the Covered Entity without unreasonable delay and in no event later than 10 business days after discovery — except where a law-enforcement delay applies or more urgent notice is required by law.

The complete BAA is published at /baa.html. Procurement and security teams are welcome to read it before signup.

AI & PHI

Yes, we use AI. No, it doesn't see your PHI.

UPStandards uses AI for document drafting, policy gap analysis, and the in-app Helper. The architecture and the contract are both built around one principle: PHI does not go to AI providers.

Three things make that hold up in practice rather than just on paper.

  • Server-side proxying. Customers never hold an Anthropic API key. AI requests are forwarded through a UPStandards-controlled edge function that authenticates the user, checks tier-based usage quotas, and logs the call before forwarding it to Anthropic.
  • Architectural separation. The platform is designed for an accreditation-and-compliance data set, not full clinical records. The Terms restrict customers from submitting diagnoses, progress notes, psychotherapy notes, SUD counseling notes, lab results, prescriptions, or full medical records — the kinds of data that have no place in an AI request.
  • Contractual prohibition. Section 5 of the BAA prohibits UPStandards from transmitting PHI to Anthropic or any non-BAA vendor. Anthropic's commercial terms, in turn, specify that API inputs are not used to train models.

"AI inputs should be aggregate, de-identified, or otherwise non-PHI." — Terms of Service §8

Per-organization AI quotas are enforced server-side and visible in your account. Every successful AI call is recorded in an ai_usage_events log so you can audit what was used and when.

Authentication & Access

SSO, email, and role-based access.

Most workforce users sign in with their existing identity provider. Email and password remain available for organizations that haven't moved to SSO.

  • Sign in with Google — for organizations using Google Workspace.
  • Sign in with Microsoft — Entra ID / Azure AD, with the email scope required so identity is established correctly.
  • Email and password — minimum 8 characters; a password manager is recommended.
  • Self-service password reset — Supabase-issued recovery links, valid for one hour, single-use.
  • Role-based permissions — organization admins, billing admins, clinicians, and standard workforce roles each see only the parts of the platform they need.
  • Audit log — retention varies by tier (30 days on Starter, 1 year on Basic, 3 years on Pro).

Per the BAA, the Covered Entity is responsible for promptly disabling access for workforce members who no longer require it, configuring user permissions to follow the minimum-necessary standard, and notifying UPStandards of suspected credential compromise.

Data Lifecycle

Storage, retention, and getting your data out.

You own your data. UPStandards processes it under the BAA and the Data Processing Addendum, and gives it back to you whenever you ask — including after you cancel.

While you're a customer. Customer Data may be exported at any time through standard platform features. Saved documents, signed BAA executions, chart-audit records, and policy library entries are all retrievable from inside the app.

After termination. Standard self-serve accounts receive a 30-day post-termination export window. Enterprise Order Forms may provide 60 to 90 days. After the applicable window, UPStandards may delete, de-identify, or retain data according to its retention practices, the BAA, the DPA, backup cycles, and applicable law.

Backups. Backup copies may persist temporarily according to backup cycles. They remain protected and are not used for purposes unrelated to providing, securing, or supporting the Services.

Geography. UPStandards is intended for U.S. customers at launch. We do not currently target EU or UK customers. If international processing becomes applicable, additional transfer terms and subprocessor review are required before that processing begins (DPA §12).

Customer Data ownership. Customer Data belongs to the Customer. UPStandards receives only the rights necessary to host, process, display, transmit, and use Customer Data to provide, secure, support, and improve the Services (Terms §16).

Subprocessors

The five vendors that touch the platform — and what each one can see.

The "Privacy / HIPAA Position" column reflects the design intent of the platform and the contractual position with each vendor.

Vendor
Role
Privacy / HIPAA Position
Supabase
Managed Postgres database, authentication, storage, and backend infrastructure (including the AI proxy edge function).
PHIHIPAA-tier infrastructure. Expected to host the platform PHI database and related access and authentication components. BAA required and in progress before production PHI use.
Postmark
Transactional email delivery (account, authentication, billing, security, support).
No PHIEmail content uses a no-PHI architecture by design. No patient identifiers, chart or audit details, Part 2 information, or other PHI is placed in transactional email.
Stripe
Payments, invoices, and subscription billing.
No PHIBilling and account metadata only. Patient, clinical, audit, and accreditation-record details are not transmitted to Stripe.
Netlify
Frontend hosting and CDN for static HTML, JS, and CSS assets.
No PHINo PHI stored on frontend servers. The application architecture keeps PHI out of URLs, query strings, static files, logs, and client-side telemetry.
Anthropic
AI-assisted policy drafting, document generation, and report refinement.
No PHIAggregate or de-identified inputs only. PHI, patient identifiers, Part 2 Records, named-patient logs, and identifiable audit findings are contractually walled off from AI providers.

This list reflects the current product stack and is updated as it changes. The authoritative version is published in the Privacy Policy (§10) and Schedule 3 of the Data Processing Addendum.

Shared Responsibility

What we do. What you do.

HIPAA assigns responsibilities to both the Covered Entity and the Business Associate. The platform is built around that split.

UPStandards (Business Associate)

  • Execute and maintain a BAA with every customer organization.
  • Host the platform on HIPAA-tier infrastructure (Supabase).
  • Proxy AI calls server-side; enforce per-organization quotas; log AI usage.
  • Implement administrative, physical, and technical safeguards (Section 6 of the BAA).
  • Apply row-level security so customer organizations only see their own data.
  • Report Breaches of Unsecured PHI within 10 business days of discovery.
  • Provide a 30-day post-termination data export window for standard accounts.
  • Maintain workforce confidentiality, vendor review, and incident response procedures.

Customer (Covered Entity)

  • Determine what may be entered into the Services; follow the minimum-necessary standard.
  • Avoid placing prohibited data into the platform (full medical records, psychotherapy notes, SUD counseling notes, lab results, billing PHI).
  • Configure user roles and permissions to match your workforce.
  • Train Authorized Users on appropriate use.
  • Promptly disable access for workforce members who no longer require it.
  • Notify UPStandards of suspected credential compromise.
  • Maintain your EHR, designated record set, patient notices, and Part 2 consents outside UPStandards.
  • Validate AI-assisted outputs before relying on them.
The Documents Behind All of This

Five documents. All public. All readable.

If you're in procurement or IT review, here's everything you need.

Reporting Concerns

Who to email when something matters.

Security or privacy questions

Send privacy and data-protection inquiries to privacy@upstandards.net.

General support and account questions go to support@upstandards.net.

Suspected breach or unauthorized access

If you suspect a security incident affecting PHI processed through UPStandards, contact privacy@upstandards.net immediately, with "Security Incident" in the subject line. We'll respond promptly and follow the breach-reporting commitments in Section 7 of the BAA.

Postal mail

UPStandards LLC
PO Box 1554
Cobb, CA 95426

Security FAQ

The questions procurement teams ask first.

Does UPStandards sign a Business Associate Agreement?

Yes. Every customer organization signs a BAA with UPStandards LLC before using the platform with real Protected Health Information. The agreement covers HIPAA's Privacy, Security, Breach Notification, and Enforcement Rules at 45 CFR Parts 160 and 164.

The executed copy of your BAA is available from inside your account on the Your Business Associate Agreement page, with both parties' names and titles, signature (drawn or typed), the version of the BAA you accepted, the signing IP address, and the timestamp.

Does UPStandards send our PHI to AI providers like Anthropic?

No. Section 5 of the BAA prohibits UPStandards from transmitting PHI to Anthropic or any non-BAA vendor unless the parties amend the Services architecture and contractual terms. The Terms reinforce this: "AI inputs should be aggregate, de-identified, or otherwise non-PHI."

Architecturally, AI calls go through a server-side proxy that customers never see — there's no Anthropic API key in the customer's hands — and every successful call is logged in the ai_usage_events table for audit.

Anthropic's commercial terms, in turn, specify that API inputs are not used to train models.

If there's a security incident, how quickly will UPStandards notify us?

Section 7.1 of the BAA commits UPStandards to reporting a Breach of Unsecured PHI without unreasonable delay and in no event later than 10 business days after discovery — except where a law-enforcement delay applies or more urgent notice is required by law.

The DPA adds parallel commitments for Personal Data: notice "without undue delay" after becoming aware of a confirmed security breach, including the nature of the incident, affected data categories, likely consequences, measures taken or proposed, and a contact point.

What happens to our data if we cancel?

Standard self-serve accounts have a 30-day post-termination export window. Enterprise Order Forms may provide 60 to 90 days. After the applicable export period, UPStandards may delete, de-identify, or retain data per its retention practices, BAA, DPA, backup cycles, and applicable law.

Backup copies may persist temporarily but remain protected and are not used for unrelated purposes.

What single sign-on options are supported?

Sign in with Google or Microsoft (Entra ID / Azure AD), or with email and password. Password sign-in requires at least 8 characters. Self-service password reset is available via email recovery — recovery links are valid for one hour and can only be used once.

Who are UPStandards' subprocessors?

Five disclosed subprocessors at the time of this writing: Supabase (managed Postgres, authentication, edge functions — handles platform PHI under BAA-tier infrastructure), Postmark (transactional email, no PHI in content), Stripe (payments, no PHI), Netlify (frontend hosting, no PHI), and Anthropic (AI document drafting and policy support, aggregate or de-identified inputs only).

The authoritative list lives in §10 of the Privacy Policy and Schedule 3 of the Data Processing Addendum. It is updated as the product stack changes.

What kinds of data should NOT be entered into UPStandards?

UPStandards is built for a limited accreditation, safety, audit, and compliance data set — not full clinical records. Per Terms §6(h) and §7, users should not place the following into the platform unless a written agreement or product workflow expressly permits it:

Diagnoses, SUD diagnoses, treatment-plan content, treatment goals, interventions, modalities, progress notes, psychotherapy notes, SUD counseling notes, full medical records, lab results, imaging, prescriptions, billing PHI, and financial PHI.

Some workflows do involve named-patient identifiers where operationally necessary — Q15 patient safety observation logs, restraint and seclusion documentation, and certain chart-audit fields. The platform supports those workflows specifically; everything outside them belongs in your EHR.

Is the platform an EHR or a substitute for clinical documentation?

No. Per Terms §3, UPStandards is not an electronic health record, designated record set, patient portal, emergency service, clinical documentation system, diagnosis tool, treatment-planning platform, billing platform, utilization-management system, legal-advice platform, accreditation-body representative, or substitute for professional judgment.

UPStandards lives alongside your EHR and handles the operational, audit, policy, and accreditation-readiness workflows that an EHR isn't built to handle.

Procurement-ready before you ever talk to sales.

Start a free trial. Full access. Cancel anytime.

Start Free Trial Book a walk-through