Trust & Compliance

HIPAA & Business Associate status

When you use Automate Admits to communicate with patients and leads, we act as your Business Associate under the HIPAA Rules (45 CFR Parts 160 and 164). You remain the Covered Entity (or, in some arrangements, another business associate) and control the care relationship; we provide the software and process protected health information (PHI) only to deliver the Service on your behalf.

We are software, not a healthcare provider — we do not provide medical, clinical, or treatment advice, and we are not part of your care team. But because your conversations can include PHI, we take on the safeguards, reporting, and contractual obligations that HIPAA requires of a business associate.

Standing Business Associate Agreement (BAA)

We publish a single, standing BAA that applies to every customer — you don't need to negotiate or sign a separate agreement for your organization. By subscribing to and using Automate Admits to handle PHI, your organization accepts the standing BAA by reference; it is incorporated into our Terms of Service and takes effect the moment the Service is used with PHI.

The standing BAA commits us to, among other things:

• Using and disclosing PHI only to provide the Service, as permitted by the BAA, or as required by law;
• Limiting use and disclosure to the minimum necessary;
• Implementing administrative, physical, and technical safeguards and complying with the HIPAA Security Rule;
• Binding every subcontractor that handles PHI to written confidentiality and security obligations, and executing a business associate agreement with each one that will sign one — the current status of every subprocessor is published below;
• Reporting security incidents and breaches, and notifying you of a breach of unsecured PHI within 60 days of discovery;
• Making PHI available for access, amendment, and accounting of disclosures as required;
• Making our practices available to HHS for compliance review;
• Returning or destroying PHI on termination where feasible.

The published BAA governs; this summary is for orientation only.

42 CFR Part 2 — substance use disorder records

Many of our customers are substance use disorder (SUD) treatment programs. Where the Service is used by a Part 2 program, we act as a Qualified Service Organization (QSO). Every account owner accepts our QSO agreement at signup, and that acceptance is recorded against the account.

What we commit to

• We hold records received from a Part 2 program in confidence and use them only to provide the contracted Service — never for marketing, resale, model training, or any other purpose.
• We are fully bound by 42 CFR Part 2 with respect to those records, and we will resist in judicial proceedings any effort to obtain them other than as Part 2 permits.
• We disclose those records only to the subprocessors listed below, each of which is engaged under written confidentiality and security obligations.
• We apply the same technical safeguards to Part 2 records as to all other PHI.

What the platform does not do — read this

As the covered program, you are responsible for obtaining, documenting, and honoring any patient consent required before information is entered into or sent through the platform, for applying the required notice prohibiting redisclosure to anything you send out of it, and for maintaining any accounting of disclosures Part 2 requires of you. We give you a per-organization compliance checklist inside the app that includes a periodic Part 2 consent review, but the checklist is a reminder — the review itself is manual and performed by your team.

See our 42 CFR Part 2 statement for the full detail.

Security program

PHI is encrypted in transit (TLS) and at rest, access is role-based and least-privilege, passwords are stored only as salted hashes, and two-factor authentication is available. PHI access and account changes are recorded in a per-organization activity log. Full technical detail is on our Security page.

Because the AI agent must read message content to draft replies, the Service is not end-to-end encrypted; data is encrypted in transit and at rest and access-controlled.

Subprocessors

This is the complete list of providers that receive customer data when you use the Service. Every one is engaged under contractual confidentiality and security obligations. Where we have executed a business associate agreement, we say so; where we have not, we say that too. We do not claim BAAs we do not hold.

About the four providers without a BAA

• Anthropic makes an AI assistant our own staff use when investigating a support request or a problem. It can see only the parts of a conversation or contact record needed for that investigation, and it is never used to generate automated replies; those are generated on Amazon Bedrock, under our BAA with AWS. We do not hold a BAA with Anthropic.
• Meta operates Facebook Messenger and Instagram. If you connect those channels, the conversation happens on Meta's platform by definition, and Meta's own terms — not ours — govern that copy of it. Meta does not offer a BAA for these APIs.
• Apple delivers alerts to the iPhone app. Alerts are optional and never include message content, but they can show a contact's name and profile photo, so Apple's push service handles that much. Alerts in a web browser are encrypted end to end and cannot be read by the browser's push service.
• Telnyx carries SMS and voice. Carriers generally handle message and call traffic as transport rather than under a BAA. Voice messages a lead sends on a connected Facebook, Instagram or SMS channel are sent to Telnyx's speech-to-text service (OpenAI Whisper) so the AI agent can read and answer them. If you enable call transcription, call audio is sent there as well.

How to reduce your exposure. AI replies are generated within AWS on Amazon Bedrock, under our business associate agreement with AWS, so the AI agent does not add a provider without a BAA. What you can control: leave the Facebook and Instagram channels disconnected so Meta never holds a copy of the conversation, leave call transcription off so no call audio reaches Telnyx's speech-to-text service (voice messages on connected channels are always transcribed), leave iPhone app alerts off (or use browser alerts, which are encrypted end to end), and instruct the AI agent to collect only the minimum necessary. If your compliance posture requires a BAA with every downstream processor, talk to us at admin@automateadmits.com before you go live. We will update this page the moment any of these agreements is executed.

We give notice before adding or replacing a subprocessor that handles PHI. To be notified, email admin@automateadmits.com.

Data handling & retention

• Each organization's data is logically isolated in our multi-tenant database and scoped to that organization on every request. We run an automated tenant-isolation audit against the codebase as part of our release process.
• Contacts, conversations, messages, call recordings, and transcripts are retained until they are deleted. There is no automatic expiry on this data — it is kept for the life of the account. You can delete a contact or a conversation at any time from the app, and we delete or return your data on request within a reasonable period after termination.
• The security activity log is retained for six years (the HIPAA 45 CFR 164.316(b)(2) documentation horizon) and then purged automatically. Failed-login records and rate-limit counters are purged on a much shorter cycle.
• Individual data-deletion requests are honored across the platform; see our Privacy Policy.
• Payment card data is handled solely by our PCI-compliant payment processor and is never stored on our servers.
• Copies of message content that reach Meta, Telnyx, or Anthropic are governed by those providers' own retention practices, not ours. For Anthropic, that includes copies it received through September 24, 2026, while AI replies and conversation summaries ran on Anthropic's own API. Deleting a conversation in Automate Admits does not delete Meta's copy of a Messenger or Instagram thread.

Incident & breach response

On discovery of a security incident or breach of unsecured PHI, we contain and investigate, and notify affected customers without unreasonable delay and no later than 60 days after discovery, in accordance with 45 CFR 164.410. Report a suspected incident to admin@automateadmits.com.

Compliance roadmap

We are an early-stage company and we build our compliance program in the open. Current status:

• Standing BAA and Security Rule safeguards — live today.
• Subprocessor BAAs: executed with Amazon Web Services, Paubox, and Stedi. Telnyx has indicated a BAA may be available in future and we are pursuing it; Meta does not offer one for the interfaces we use, and we do not hold one with Anthropic. Since September 24, 2026, the AI agent runs on Amazon Bedrock under our AWS agreement. Status is published in the table above and updated when it changes.
• Part 2 consent management — not built. We act as a QSO and we have a manual consent-review checklist item, but in-product consent capture, revocation, segmentation, and disclosure accounting are on the roadmap, not shipped.
• SOC 2 Type I — on our roadmap; we are formalizing the controls and documentation needed to pursue a report. This is a stated goal, not a current certification.
• Independent penetration test — not yet performed.

We will update this page as our program matures. If your due-diligence process needs specific documentation, contact us.

Contact

Automate Admits is operated by Automate Admits, Inc. This page is provided for general information and is not legal advice. The published Terms of Service, Privacy Policy, DPA, 42 CFR Part 2 statement, and standing Business Associate Agreement govern the relationship between you and Automate Admits, and are governed by the laws of the State of Wyoming.