Skip to the main content.
Talk to sales Start for free
Talk to sales Start for free

3 min read

Is HIPAA compliant? (Update 2024)

Is HIPAA compliant? (Update 2024) is a partnership management platform that streamlines workflows and provides access to performance metrics and actionable insights. Many healthcare organizations use such solutions to better connect and communicate with employees, patients, and other healthcare providers. To do so, however, those within the healthcare industry need to work with companies that are HIPAA compliant.

In the healthcare industry, sensitive protected health information (PHI) must be safeguarded under HIPAA. A major part of this compliance is working with vendors who will sign a business associate agreement (BAA) and ensure the security of PHI. still does not mention a BAA on its website and may not be HIPAA compliant.


What is considers itself a world leader in partnership management platforms, transforming the way organizations manage and optimize their associations. The company helps organizations build ‘authentic’ relationships with affiliates, influencers, commerce content publishers, and business-to-business (B2B) enterprises. allows users to automate communication tasks and expand rapidly, tracking and analyzing customer interactions across the Internet and various apps.

With this platform, organizations can centralize and standardize customer information to improve and enrich their customers’ journeys.

SEE ALSOUnderstanding the patient journey


Is a business associate?

HIPAA applies to covered entities, which include healthcare providers, health plans, and healthcare clearinghouses. It also applies to business associates (i.e., vendors) of these covered entities. These are entities that perform certain functions or activities on behalf of the covered entity.

A BAA is a written contract between a covered entity and a business associate. It outlines the responsibilities and obligations of each party regarding the handling of PHI. Typical provisions within a BAA include:

  • Permitted uses and disclosures of PHI
  • Safeguards for protecting PHI
  • Reporting and mitigation of security incidents
  • Compliance with HIPAA regulations
  • Dispute resolution and termination clauses

The agreement is required by law for HIPAA compliance and is considered the primary item to consider when it comes to and its ability to be HIPAA compliant. is a business associate of a healthcare organization if it is storing, processing, or transmitting PHI on or through its platform.

RELATEDHow to know if you're a business associate and the BAA

Generally, the HIPAA Privacy Rule allows healthcare providers to disclose PHI if they receive assurance that the information is protected through a signed BAA. We checked’s website in 2022 for reference to an agreement but found no mention of a BAA or HIPAA. Currently, there is still no mention of either at and data security

Covered entities must consider the administrative, physical, and technical safeguards that a vendor utilizes to protect PHI. To accurately provide analytics, management platforms must have access to personal information to facilitate communication. With the increasing importance of data privacy and security, all healthcare business associates who collect, store, or process PHI are subject to HIPAA regulations. Many management platforms are available, but not all meet HIPAA requirements for encryption, data backup, and access controls.

Information on the company’s disclosure of personally identifiable information (PII) and cybersecurity was not easy to find. According to’s privacy policy, customer’s personal information is used for legitimate business purposes only; it does not rent or sell PII. As for end users, states that it might process “clients’ visitors and customers, and visitors to our Clients’ websites” as a service provider or data processor.

Within its privacy policy, adds that it “strive[s] to implement and maintain reasonable, commercially acceptable security procedures” though it is “unable to guarantee the absolute security of the Personal Information [it has] collected from you.”


Is HIPAA compliant?

The BAA is a necessary component of HIPAA compliance and does not appear to sign a BAA for its healthcare customers. Moreover, does not provide much information about its cybersecurity procedures.

Conclusion: may not be HIPAA compliant.


Understanding HIPAA compliance

Healthcare providers know that clear and efficient communication with patients is necessary to run a successful practice. When evaluating a platform’s HIPAA compliance, especially on the cloud, consider the following security needs beyond a BAA:

  • Technical safeguards: Mitigate risks associated with cyber threats, hacking, malware, and other security incidents with strong technical safeguards. Such tools as perimeter defenses (e.g., firewalls) and HIPAA compliant email are equally vital for extra protection.
  • Employee training: Ensure all staff members have up-to-date knowledge of HIPAA regulations and best practices. Regular training sessions can help prevent unintentional, employee-related breaches.
  • Regular audits: Perform periodic assessments of all systems and processes to ensure that they remain compliant. Adapt to any changes in regulations or technology.
  • Data access controls: Implement stringent controls, such as multifactor authentication, on who can access PHI and under what circumstances.

Subscribe to Paubox Weekly

Every Friday we'll bring you the most important news from Paubox. Our aim is to make you smarter, faster.