Your patient data stays in your systems, under your rules

What we touch, and what we do not

Whether a vendor is a business associate depends on the data that actually reaches it, not on what the vendor calls itself. HHS said so plainly in 2013: a vendor becomes one by definition, not by signing a contract. So here is our answer in terms of data.

When a task does need one of those systems, the next section applies, and we treat that work as business associate work, with every duty that comes with it. We do not claim the "conduit" exception. HHS calls it a narrow one, meant for courier services like the Postal Service, and says a vendor that maintains health information for a covered entity is a business associate even if it never views that information.

When we are given access: the controls

Sometimes a center gives us access to a forms inbox, a CRM or a call tracking account so we can set something up or find out why it stopped working. When that happens, these rules apply every time.

1. 01

   BAA first. We do not sign in to a system that holds patient information until a Business Associate Agreement with your center is in place.

2. 02

   Named accounts. You add us as a named user in your system. We never use a shared login, or a password passed along by email or chat.

3. 03

   Multi-factor authentication. It is on for every account we use to reach your systems, and on our own email and workspace.

4. 04

   The least access the task needs. Read-only where read-only works. Admin rights only when the setting we need sits behind them, and only for that task.

5. 05

   One person per task. Access goes to the person on our team doing the work, under their own name, and to no one else.

6. 06

   Access ends when the task does. We tell you in writing that the task is finished, and our user is removed, by you, or by us where your system allows it.

7. 07

   Patient data stays where it is. We do not export or download it, copy it into our own tools, paste it into chat, email or AI tools, or capture it in screenshots or screen recordings.

8. 08

   Test data, not patient data. We test forms and tracking with clearly labeled test submissions we make ourselves. To trace a fault, we open only the records the task needs.

9. 09

   Your logs show our work. Most systems keep a record of sign-ins and changes. Because we work under a named user, ours appear there under our name.

10. 10

    Where we work from. Our team works from Islamabad, Pakistan. If your policy or a payer contract limits access to patient information from outside the United States, tell us before the task starts, and we will plan the work so no patient information is visible to us, for example by guiding your team through the change.

If something goes wrong

If we learn that patient information may have been used or disclosed in a way it should not have been, we tell you without unreasonable delay, and within the window your BAA sets. The legal outer limit for a business associate is 60 calendar days from discovery. That is a ceiling, not our target, and the clock starts when we know, or with reasonable diligence would have known.

We notify you, the covered entity. Notices to patients, HHS and the media are yours to make, unless your BAA asks us to help with them. Our notice names the people affected as far as we can identify them, and we send whatever else you need for your own notices as we learn it.

We report security incidents as well as confirmed breaches, because the Security Rule requires a BAA to cover both. And we never decide on our own that an exposure was harmless. Under 45 CFR 164.402, an impermissible use or disclosure is presumed to be a breach unless a risk assessment of at least four factors shows a low probability that the information was compromised.

The same goes for problems we did not cause. If we find a tag on your current site sending form contents or identifying details to an analytics or ad platform, we tell you in writing as soon as we find it.

Business Associate Agreements

We sign a Business Associate Agreement before work starts, whenever you ask for one. Send us your template. We read it, raise anything we cannot meet before we sign, and then we meet it.

A BAA is required paperwork, not proof of compliance. HHS makes the same point from the other side in its tracking guidance: signing an agreement with BAA terms does not make a tracking vendor a business associate if it does not meet the definition. What the agreement has to contain is set by 45 CFR 164.504(e) and 164.314(a), and we check that any agreement we sign covers it:

• The uses and disclosures of patient information we are permitted and required to make, and no others.
• Appropriate safeguards, including Security Rule compliance for electronic health information.
• Reporting to you of any use or disclosure the agreement does not allow, any security incident, and any breach of unsecured information.
• The same restrictions passed down to any subcontractor that handles your patients' information.
• Help with patients' rights to access, amend and get an accounting of their information, where those apply.
• Following the Privacy Rule for any of your obligations we carry out on your behalf.
• Our practices, books and records on your patients' information made available to HHS when it asks.
• Return or destruction of patient information when the work ends, where feasible.
• Your right to end the contract if we materially violate it.

Subcontractors

A subcontractor that handles patient information for us is a business associate too, and needs its own agreement with us. Today none does, because none of our tools hold patient information (see the table below). If that ever changes, the subcontractor signs first, and you hear about it before any of your data reaches them.

What a BAA does not let us do

A business associate may use patient information only as its agreement permits or as the law requires. So your patients' information never becomes our case study, our benchmark or an ad audience. A BAA is also not a patient's authorization: HHS says disclosing health information to tracking vendors for marketing, without patients' HIPAA authorizations, is impermissible.

Who we answer to

Since September 23, 2013, business associates have been directly liable to HHS for a defined set of duties: Security Rule safeguards, breach notice to the covered entity, no impermissible uses or disclosures, the minimum necessary standard, agreements with subcontractors, and cooperation with HHS. Everything else in your BAA binds us by contract.

What is still only a proposal

HHS proposed changes to the HIPAA Security Rule on January 6, 2025. As of October 15, 2026 they have not been finalized, so this page describes the rule in force today. We will update it if that changes.

Tracking and analytics

This is where most treatment center websites get into trouble, and where the rules moved in 2024. Here is what changed, what did not, and how we set tracking up.

What the court changed

HHS issued guidance on online tracking technologies on December 1, 2022, and revised it on March 18, 2024. On June 20, 2024, in American Hospital Association v. Becerra (N.D. Tex., No. 4:23-cv-01110-P), Judge Mark T. Pittman declared one part of the revised guidance unlawful and vacated it: the position that HIPAA is triggered when an online technology connects an individual's IP address with a visit to an unauthenticated public page about specific health conditions or healthcare providers. The court declined to issue an injunction.

HHS filed an appeal on August 19, 2024, then had it dismissed on its own motion, effective September 4, 2024, so no appeals court has ruled. HHS's guidance page now says it "is evaluating its next steps." As of October 15, 2026, the page's last reviewed date is June 26, 2024.

What it did not change

The court said its ruling should not be read as limiting the rest of the guidance. That rest still says:

• Tracking on pages behind a login, such as patient portals and telehealth platforms, generally has access to protected health information.
• Tracking on appointment pages, symptom checkers and portal login or registration pages may capture it, such as an email address, or a reason for seeking care that a visitor types or selects.
• A cookie banner is not a HIPAA authorization.
• A tracking vendor's promise to strip or de-identify health information after it arrives is not enough.
• Disclosing health information to tracking vendors for marketing, without patients' HIPAA authorizations, is impermissible.

The court drew the same line itself: a page that asks visitors why they are there is different from a page they simply view. The HIPAA definitions of health information did not change. And HIPAA is not the only law. HHS's guidance notes that where HIPAA does not apply, "other law may apply." In April 2024 the FTC announced a proposed settlement with Monument, an online alcohol addiction treatment service, over charges that it disclosed users' health information to advertising platforms. The charges included the Opioid Addiction Recovery Fraud Prevention Act of 2018.

Google Analytics

Google does not offer a Business Associate Agreement for Google Analytics, and makes no representation that it meets HIPAA requirements. Its help page tells HIPAA-regulated customers not to place Analytics tags on HIPAA-covered pages, says unauthenticated pages related to the provision of health care are more likely to be covered, and asks customers to work with their legal team to identify the pages that are not. That guidance is Google's own, and it still points to the HHS bulletin.

How we set tracking up

• Before launch, you get a written tag map: every page, every tag that fires on it, and what each tag sends. Your compliance lead decides which pages carry analytics.
• No third-party tags on patient portals, login or registration pages, or any page behind a login.
• Pages your team marks as HIPAA-covered carry no Google Analytics or ad platform tags. We count their conversions from your own form tool, CRM or call tracking account instead.
• Form contents never go to analytics or ad platforms. An event can record that a form was sent. It never carries what the form said.
• No names, email addresses or phone numbers go to analytics or ad platforms, hashed or not. We do not set up enhanced conversions, customer list uploads or server-side conversion feeds built from patient or lead details.
• No health details or identifiers in URLs. Query parameters that could identify a person are stripped before any tag fires.
• Forms submit to a system your center runs under its own BAA, never to an inbox or database we hold.
• Call tracking runs in your account. Analytics receives call counts by source, not caller numbers or recordings.
• A cookie banner is never our answer to a HIPAA question.

GA4, call tracking and form tracking still go in before launch, with a recorded baseline. The baseline is built from counts, not from people.

42 CFR Part 2, for substance use treatment programs

Part 2 protects substance use disorder patient records held by federally assisted programs. Whether your center is a Part 2 program is a question for your counsel; the regulation defines federal assistance in 42 CFR 2.12(b). Its definition of a record is broad: it names emails, voice mails and texts, not only clinical files.

HHS rewrote Part 2 in a final rule published February 16, 2024. It took effect on April 16, 2024, and compliance has been required since February 16, 2026. Among other changes, it applies the HIPAA breach notification rules to Part 2 programs for breaches of unsecured records.

What it means for us

• If your program is also a HIPAA covered entity, a vendor that is your business associate is also a "qualified service organization" for records covered by Part 2 (42 CFR 2.11).
• A qualified service organization needs a written agreement with your program in which it acknowledges it is fully bound by Part 2, and agrees to resist, in judicial proceedings if necessary, any effort to obtain patient identifying information except as Part 2 permits.
• In the 2024 rule, HHS said a qualified service organization agreement "should be understood as distinct from" a HIPAA BAA. So for a Part 2 program, the agreement we sign includes those Part 2 terms, inside your BAA or as a separate agreement.
• HHS guidance, which the 2024 rule kept in place, says a qualified service organization may not pass Part 2 information to a third party, except a contract agent helping with the same services who discloses it only back. We do not pass Part 2 information to anyone, and none of our tools hold it.
• HHS chose not to put qualified service organizations directly under the new Part 2 breach rule, and said programs are likely to address breach notice in the agreement. We accept the same notice terms for Part 2 records that we accept for other patient information.

Every control in the access section above applies to Part 2 records in the same way.

Advertising rules: LegitScript, patient brokering and EKRA

LegitScript

In the United States, Google allows addiction services ads only from advertisers "certified as an addiction services provider by the LegitScript Certification program." Meta requires LegitScript certification and Meta's own written permission. LegitScript says its certification is required to run addiction treatment ads on platforms including Google, Meta, Microsoft Ads and Nextdoor.

Every page we build is checked against what LegitScript reviews before it launches, on every tier: verified testimonials only, accurate treatment claims, no outcome guarantees, licensing and accreditation shown, a real address and a privacy policy. Certification itself is between your center and LegitScript. We are not affiliated with LegitScript and cannot certify anyone.

LegitScript lists a "lead generator, call center, or marketer referring patients to other providers in exchange for compensation" as explicitly disallowed, and says affiliation with a lead generator may be grounds for immediate denial. We are none of those. We do not buy or sell leads, run a hotline, or refer patients to any provider. Every inquiry goes to your own admissions team.

EKRA and patient brokering

The Eliminating Kickbacks in Recovery Act (18 U.S.C. 220, enacted October 24, 2018) makes it a federal crime, for services covered by a health care benefit program, to knowingly and willfully pay or receive any remuneration in return for referring a patient to a recovery home, clinical treatment facility or laboratory, or to induce such a referral. The penalty is a fine of up to $200,000, up to 10 years in prison, or both, for each occurrence. Its exception for employee and contractor pay depends on that pay not being determined by, or varying with, the number of people referred, the tests or procedures performed, or the amount billed.

Some states add their own law. Florida's Patient Brokering Act (Fla. Stat. 817.505) makes it unlawful to offer, pay, solicit or receive a commission, bonus, rebate, kickback or bribe, or to engage in a split-fee arrangement, to induce or in return for a patient referral, and to "aid, abet, advise, or otherwise participate" in that conduct. If you operate in other states, your counsel will know their rules.

How we are paid

This is why the way a marketing vendor is paid matters. KhanWork is paid a flat monthly fee for each tier. Never per lead, per call, per form or per admission, and nothing we are paid changes with how many patients you admit or what you bill.

What we will not build

• Anything that pays, or takes, a fee for a referral.
• Ads or pages that use another center's name to catch its searches. In January 2025 the FTC sued Evoke Wellness, alleging that its search ads impersonated the clinics people were searching for.
• Offers to pay for travel, rent or insurance premiums. LegitScript says applicants that offer to pay for travel will generally not be eligible.
• Outcome guarantees, or success rates you cannot back with evidence.

What we are not

We are not certified. We have no SOC 2 report, no HITRUST certification and no ISO 27001 certification, and we will not call ourselves "HIPAA certified." HHS does not endorse or recognize private organizations' certifications of Security Rule compliance.

We are also not your compliance officer or your lawyer. This page describes what we do. Your counsel decides what your center needs.

How we work inside your policy instead

• Your rules come first. Where your policy is stricter than this page, your policy wins.
• We answer your security questionnaire in full and in writing, including the questions where our answer is no.
• We sign your BAA, and for Part 2 programs, the qualified service organization terms.
• We follow your access process: your user accounts, your multi-factor authentication, your single sign-on if you use it, and any training you require of vendors.
• We work in your systems, so your controls and your logs cover our work.

Who owns what

Everything we deliver belongs to your center: the files, the pages, the code and the brand assets. Your site, hosting, domains and analytics are set up in your own accounts from the start, so we never hold a site, and nothing is stuck with us the day we stop working together.

When we part ways

Our users come out of your accounts, you get the working files, and we confirm in writing that we hold no patient information. Under a BAA, anything we did hold would be returned or destroyed where feasible. In practice there should be nothing to return.

The tools we use, and what each one holds

These are the tools on our side. Your form tool, CRM, call tracking and analytics are not on this list, because they are yours and live in your accounts.

"None" means none. We do not put patient information into these tools, and we ask your team not to send it to us through them. If it reaches us anyway, we tell you and remove it from our systems, so you can decide whether a breach risk assessment is needed.