Privacy Policy

I. Who is HowToHIPAA?

HowToHIPAA is a business-to-business HIPAA compliance-management software platform. We help organizations (primarily HIPAA covered entities and the service providers that support them) assess, document, train on, benchmark, and track their HIPAA compliance program. Features include self-assessments against the HIPAA Security and Privacy Rules, policy and procedure templates, workforce training and attestation, risk analyses, vendor/business-associate registries, peer benchmarking, and related compliance tooling.

HowToHIPAA is administrative software. We are not a health care provider, not a covered entity, and not a Business Associate, and the Platform is not designed to receive, store, or process Protected Health Information (PHI). You operate your own compliance program using our tools; the information you put into the Platform is your organization's compliance and administrative information, not patient health records. See Section II (“Not a Business Associate; no PHI”) for what this means for you.

II. Key Terms & Definitions and Our Privacy Policy

Some key terms used in this Privacy Policy:

• “Personal Information”: information relating to an identified or identifiable individual.
• “Platform”: our Website and our hosted Software (the application at howtohipaa.com).
• “Privacy Policy”: this privacy policy.
• “Services”: the compliance-management services provided through the Platform.
• “Software”: our hosted web application.
• “Terms of Service”: our terms of service.
• “Website(s)”: our websites, including www.howtohipaa.com.
• “Customer,” “you,” “your”: the organization that subscribes to the Services and its authorized users.
• “HowToHIPAA LLC,” “we,” “us,” “our”: HowToHIPAA LLC.

When does our Privacy Policy apply?

This Privacy Policy describes the information we may collect when you:

• visit or use our Platform, including our Website and Software;
• create or use an account, or are invited to an organization's account;
• communicate with us by e-mail or other electronic messages; or
• contact our support team.

When does our Privacy Policy not apply?

This Privacy Policy does not apply to information collected by any third party that we do not control, even if you reach it from a link on our Platform. Those third parties have their own privacy policies.

Not a Business Associate; no PHI.

The Services are not intended to be used to submit, store, or process Protected Health Information (PHI) as defined under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). You agree not to upload or enter PHI (for example, patient names tied to treatment, diagnoses, or other individually identifiable health information) into the Platform, including into free-text fields, uploaded evidence files, or policy documents. To support this, the Platform applies automated checks designed to detect and discourage the submission of obvious PHI before certain content is processed. Because we do not act as a Business Associate and the Platform is not designed for PHI, we do not sign Business Associate Agreements (BAAs) for use of the Services. If you believe you have inadvertently submitted PHI, please Contact Us so we can help you remove it.

Our Privacy Policy and Terms of Service.

This Privacy Policy is incorporated into our Terms of Service, which also apply when you use the Platform.

III. Personal Information

What is Personal Information?

Personal Information is information that may identify you. In a business-to-business product like ours, most of the information in the Platform is your organization's compliance information rather than information about an individual; this section addresses the limited Personal Information we do handle.

What types of Personal Information do we collect?

• Account & contact information: your name, work e-mail address, organization name, and job role/title.
• Authentication information: credentials you set, or, if you sign in with Google, the basic profile and e-mail address Google provides to authenticate you (we do not receive your Google password).
• Content you provide: information you and your colleagues enter or upload to run your compliance program: self-assessment responses, uploaded evidence files, policies and procedures, training records and typed-name sign-offs, risk analyses, vendor/business-associate registry entries, imported scan or audit reports, and peer-contribution write-ups you choose to share. This content is intended to be organizational and administrative, not PHI (see Section II).
• Billing information: handled by our payment processor (Stripe). We receive subscription and transaction identifiers; we do not collect or store full payment-card numbers.
• Technical & usage information: IP address, browser/user-agent, and security/audit log entries generated as you use the Platform (used to operate, secure, and troubleshoot the Services).

We do not collect health information.

Unlike a health care provider, we do not intentionally collect Protected Health Information or other individually identifiable health information. The Platform is for compliance administration, and you agree not to submit PHI (Section II). If health information is submitted to us in error, we will treat it consistent with this Policy and applicable law and will work with you to delete it.

How do we collect your Personal Information?

• Directly from you: when you register, are invited to an organization, configure your program, upload content, communicate with us, or subscribe.
• Automatically: through essential cookies and server logs needed to operate and secure the Platform (for example, to keep you signed in and to detect abuse). We do not use analytics or marketing cookies.
• From our payment processor: Stripe sets a fraud-prevention cookie when you transact and returns transaction/subscription details to us.

Template downloads (free library). If you choose to enter your email when downloading a template, we store the email, which template you downloaded, and whether you opted into occasional HIPAA updates. We use it only to send you that template and (only if you opted in) occasional updates. Never shared or sold; ask us to delete it anytime.

How do we use your Personal Information?

• to operate, maintain, secure, and improve the Platform and Services;
• to provide the compliance features you request (assessments, policies, training, benchmarking, etc.);
• to authenticate you, administer your organization's account and user roles, and enforce seat limits;
• to process billing and subscriptions;
• to maintain a security/audit log and detect or prevent fraud or misuse;
• to respond to your requests and provide support;
• to send you service and account communications, and (where permitted) product news you can opt out of;
• to produce aggregated or de-identified analytics and benchmarks that do not identify you; and
• for any other purpose with your consent.

How do we share your Personal Information?

We do not sell your Personal Information, and we do not share it with third parties for their own advertising or marketing. We share information only as described here:

Service providers (subprocessors). We use a small set of vendors to run the Platform. Each is bound by contract to protect your information and use it only to provide services to us:

Peer-approach commons. You may contribute anonymized “how we addressed this” write-ups that other customers can view. Sharing is voluntary per write-up: nothing you type is shared unless you submit it to the commons, every contribution is identity-stripped and moderator-reviewed before it appears, and submissions are anonymous by default. Like benchmarking, the commons is a standard part of the Services.

Benchmarking. The Platform shows how your organization's compliance scores compare to similar organizations (“peers”). This works by converting your category scores into coarse score ranges and contributing them through an identity-separation layer to a shared benchmark pool. Peers are matched on coarse attributes such as organization function, size, resources, and time in operation. Because peer comparison is this contribute-and-compare exchange, it is a standard part of the Services rather than a separate opt-in. We protect it as follows:

• Identity separation: an owner-restricted mapping separates your organization from an opaque benchmark participant identifier. The current contribution tracker stores coarse cohort attributes and score ranges under that identifier so changes can be reconciled. Customer-facing comparisons use dated, privacy-gated aggregate snapshots rather than the live working pool.
• Minimum group protection: a comparison appears only when the server-side privacy floor is satisfied. We do not publish peer counts, denominators, or customer-controlled cohort filters.
• Suppression: additional safeguards withhold comparisons that could single out an organization (for example, when a peer group's scores are near-unanimous), so the numbers cannot be used to isolate any one peer.
• Modeled baseline at the start: until a peer group has enough real organizations, comparisons are supplemented by a clearly-labeled modeled baseline, phased out as real peers join.

We do not publish organization identities or individual score records. Permanent account deletion removes tenant data, the organization-to-participant mapping, the active contribution, the current snapshot self-exclusion record, and pending synchronization state; detached, identity-free aggregate snapshot history remains. These controls reduce re-identification risk, but automated aggregation is not a guarantee that re-identification is impossible. The benchmark uses group-size and suppression safeguards, not differential privacy.

Your compliance lead or assessor (service feature). If your organization uses a guided or formal engagement, the firm staff member assigned to your account (your compliance lead or assessor) can access your program information in order to perform the service you engaged them for. Access is scoped to your organization and is part of delivering those tiers.

Compliance with law. We may share information to comply with applicable law, legal process, or lawful requests from authorities, and to protect our rights, your safety, or the security of the Services.

Business transfer. If we are involved in a merger, acquisition, financing, reorganization, or sale of assets, information may be transferred as part of that transaction, subject to this Policy.

With your consent / at your direction. We may share information when you ask us to.

De-identified / aggregated information. We may use and share information that has been de-identified or aggregated so that it cannot reasonably be used to identify you (for example, product analytics and benchmark baselines).

Your choices about how we share your information.

• AI features: off by default; an administrator can enable or disable AI processing for your organization at any time in Settings.
• Peer commons write-ups: shared only when you submit one; identity-stripped and moderator-reviewed before anyone sees it.
• Cookies: you can restrict or delete cookies through your browser settings; essential cookies are needed for the Platform to function (e.g., to keep you signed in).
• Marketing e-mail: you can opt out of product/marketing e-mail using the unsubscribe link in any such message; this does not apply to service or account messages.

How do I access, correct, export, or delete my information?

• Access & correct: you can review and update your account and program information by signing in to the Platform, or Contact Us for help.
• Export / takeout: administrators can request a downloadable export of your organization's materials and data through the Platform.
• Delete: you can request deletion of your account and associated information by Contacting Us; some information may be retained where required by law, for legitimate business or security purposes, or where deletion would make remaining records inaccurate.

IV. Who may use the Services?

The Services are intended for business users in the United States who are authorized to act on behalf of their organization. The Platform and Services may not be available in every location and are not directed to users outside the United States. You represent that you are authorized to use the Services for your organization and are not barred from doing so under applicable law.

V. Children's Privacy

The Services are a business product and are not directed to children. We do not knowingly collect Personal Information from anyone under 18. If you believe a minor has provided us Personal Information, please Contact Us and we will delete it.

VI. Do Not Track signals

Some browsers offer a “Do Not Track” feature. Because there is not yet a common industry standard for how to respond, our Platform is not currently set up to respond to Do Not Track signals.

VII. Data Security

We maintain administrative, technical, and physical safeguards designed to protect Personal Information against unauthorized access, alteration, disclosure, or destruction. These measures include, among others:

• Tenant isolation: each organization's data is logically separated, enforced at the database layer (row-level security), so one customer cannot access another's data.
• Encryption: data is encrypted in transit (TLS) and at rest with our hosting providers; our database backups are additionally encrypted.
• Access controls: role-based permissions within each organization, and least-privilege internal access.
• Auditability: security-relevant actions are recorded in an audit log.
• Managed, hardened infrastructure: the Platform is hosted on managed providers behind a security/CDN edge.

No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential.

VIII. California's Shine the Light Law

California Civil Code Section 1798.83 (“Shine the Light”) lets California residents request information about a business's disclosure of Personal Information to third parties for those third parties' own direct marketing. We do not share Personal Information with third parties for their own direct marketing, so a request would return no such disclosures. You may still contact us with questions using the information below.

IX. Governing Law

This Privacy Policy and any dispute arising out of or relating to it are governed by the laws of the State of New York, without regard to its conflict-of-laws principles.

X. Changes to our Privacy Policy

We may update this Privacy Policy to reflect changes in our practices, the law, or our subprocessors. We will post the updated Policy here with a revised “last updated” date, and for material changes we will provide additional notice (for example, by e-mail to your account address or a notice in the Platform). Please review this Policy periodically.

XI. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy, contact us at [email protected] or 175 Stockholm St STE 101, Brooklyn, NY 11237, or through the “Contact Us” page on the Platform.