HIPAA Compliance

When you book a visit through MedSpot and share clinical information with a clinician, the clinician acts as the Covered Entity under HIPAA. MedSpot is a Business Associate that processes PHI on the clinician's behalf. We sign a Business Associate Agreement (BAA) with each clinician and with each subprocessor that touches PHI.

We've executed BAAs with the following vendors before they touch PHI: Supabase (database + storage), Stripe (payment metadata), Twilio (SMS), Resend (email), Daily.co (telehealth video), and Sentry (error telemetry, scrubbed). Marketing analytics vendors do not receive PHI.

• TLS 1.2+ for all data in transit; AES-256 at rest in Supabase storage.
• Postgres row-level security gates every PHI table. Clinicians can only read records for patients they have an active relationship with; patients can only read their own records.
• Authentication via Supabase Auth with required password complexity and optional biometric lock on the mobile app.
• Service-role keys are restricted to server-side code paths and audited.

Every read, write, and admin action against a PHI record is recorded to an append-only audit log with the actor, target table, target id, and timestamp. Logs are retained for at least six years per the HIPAA Security Rule.

If MedSpot becomes aware of a breach affecting PHI, we will notify impacted clinicians within 24 hours and impacted patients within the window required by HHS and your state — often 60 days, sooner where state law requires.

You have the right under HIPAA to request access to, amendment of, and an accounting of disclosures of your PHI. Submit requests to your clinician directly; MedSpot will help fulfil them in our role as Business Associate.

Questions about HIPAA compliance, requests for our BAA, or breach notifications should go to [email protected].