HIPAA applies to your organisation, not to your software.
No software is “HIPAA compliant” on its own, however it is marketed. Software can support your obligations or make them harder, but the obligations stay with the practice.
Compliance & Security
Patient Information Is Already in Your Email, Your Texts and Your Voicemail.That Is the Part Nobody Planned For.
Most practices did not decide to handle patient information this way. It happened one convenient message at a time.
CareVixis works out what actually applies to your practice, then helps you put the safeguards, policies and systems in place and keep them there.
- U.S.-Based
- Zero Outsourcing
- 24/7 Support
Nobody Ever Told You Exactly What You Are Supposed to Do.
What actually applies to us?
Plenty of advice, most of it written for hospitals, none of it telling a practice your size what to do on Monday.
Who can see what?
Logins accumulate. People change roles and keep the access they had in the last one.
Do we have this in writing?
Policies, agreements with vendors and proof of training tend to exist as intentions rather than documents.
Is texting patients allowed?
Sometimes, on the right terms, with consent recorded. Rarely from a personal phone.
What about card payments?
Taking cards brings its own requirements, and what applies depends entirely on how you take them.
Most practices do not need a lecture. They need someone to say plainly what applies to them, and then help put it in place.
Some Straight Answers, Before Anyone Sells You Anything.
These are the four things practices are most often told wrong, including by vendors. They are worth knowing before you evaluate us or anybody else.
There is no HIPAA certification to hold.
There is no government-approved HIPAA certification, for you or for any vendor. Anyone describing a practice as “HIPAA certified” is describing something that does not exist.
A signed agreement is not the same as being covered.
A business associate agreement is necessary and it is not sufficient. It sets out responsibilities; it does not by itself make anyone compliant, and the vendors who are straightest about this will tell you so themselves.
“Addressable” does not mean optional.
Where a safeguard is addressable, you assess it, implement it if it is reasonable and appropriate, or document why not and put an equivalent measure in place. What you cannot do is skip it and write nothing down.
Email security: Gmail and Workspace → Outlook and Microsoft 365 → Free email accounts →
What CareVixis Puts in Place With You.
Not a report telling you what is wrong. The work of moving patient information off the channels it should not be on, and the documentation that shows you did.
VixisSecure™ is the name for that work: protect, secure, support. It is something a U.S.-based team does with you, not a certification and not a badge, and the section below draws the line at exactly where it stops.
- Working out what actually applies to your practice
- Secure messaging and email built for healthcare
- Moving patient information off ordinary email and personal phones
- Access controls and user permissions
- Written policies and procedures
- Workforce training and the records of it
- Business associate agreements with the vendors who need them
- Consent and opt-outs recorded and honoured
- The technical safeguards behind all of it
- U.S.-based people and U.S. data centers, with zero outsourcing
How we handle patient communication → The technology behind it → Our full compliance program →
A Checklist Does Not Change Anything. Doing the Work Does.
Most practices already have a folder somewhere with a risk assessment in it. What is missing is the person who moves the email off the old account, writes the policy, runs the training and keeps the agreements current. That is the part CareVixis takes on.
- Work Out What Applies
- Fix the Obvious Gaps
- Write It Down
- Keep It Current
- U.S.-Based
- Zero Outsourcing
- 24/7 Support
And What We Do Not Do.
Being clear about the boundary is part of the job. If a vendor will not draw one, that is worth noticing.
We help you manage the process and implement the changes.
CareVixis does not perform external certifications or independent third-party assessments, and we do not describe any practice as “HIPAA certified”, because HIPAA has no certification to hold. Where an independent audit or assessment is required, it stays with the qualified third party who performs it, and we will help you prepare for it.
We do not give legal advice, and nothing here is legal advice. Your obligations are yours, and the right lawyer or assessor is sometimes the right answer. We will tell you when we think that is the case.
On card payments: what applies to your practice depends entirely on how cards are taken, and the biggest single factor is how much card data your practice ever touches. It is a question worth asking of every vendor in your payment path, including us. Tell us how you take payments today and we will walk through it with you rather than guess at it here.
Start With What Is Actually Happening in Your Practice.
Tell us how patient information moves around your practice today. We will tell you plainly what applies, what we would change first, and what you can leave alone.
- U.S.-Based
- Zero Outsourcing
- 24/7 Support
The chat window did not open. Use the button above to tell us what you need help with, or the chat launcher at the bottom right of the page.