Terms of Service

I. Acceptance of these Terms

By accessing or using the Platform, you accept these Terms on behalf of yourself and, if you are using the Platform for an organization, on behalf of that organization. You represent that you are authorized to bind that organization. These Terms, together with the Privacy Policy and any order or plan you select, form the entire agreement between us regarding the Platform and supersede any prior understanding on that subject.

II. The Service

HowToHIPAA is a business-to-business HIPAA compliance-management software platform. We help organizations (primarily HIPAA covered entities and the service providers that support them) assess, document, train on, benchmark, and track their HIPAA compliance program. Features include self-assessments against the HIPAA Security and Privacy Rules, policy and procedure templates, workforce training and attestation, risk analyses, vendor/business-associate registries, peer benchmarking, and related compliance tooling.

HowToHIPAA is administrative software. We are not a health care provider, not a covered entity, and not a Business Associate, and the Platform is not designed to receive, store, or process Protected Health Information (PHI). The Platform provides point-in-time HIPAA compliance posture assessments and related tooling; it is not a certification, and neither HowToHIPAA nor any third party certifies HIPAA compliance. You are responsible for your own compliance decisions and for how you use the outputs of the Services.

III. Accounts & Eligibility

The Services are intended for business users in the United States who are authorized to act on behalf of their organization. You must be at least 18 years old to use the Platform. When you create an account, you agree to provide accurate information and to keep it current.

You are responsible for maintaining the confidentiality of your account credentials and for all activity that occurs under your account. Accounts are provisioned to your organization; an administrator manages user roles and seat assignments and may add, disable, or remove users. You agree to notify us promptly of any unauthorized use of your account or any other breach of security.

IV. No PHI: Your Obligation

The Platform is administrative compliance tooling and is not designed to receive, store, or process Protected Health Information (“PHI”) as defined under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). The information you put into the Platform is intended to be your organization’s compliance and administrative information (policies, procedures, risk assessments, configurations, diagrams, and similar business documentation), not patient health records.

You agree not to upload, enter, or transmit PHI (for example, patient names tied to treatment, diagnoses, medical record numbers, or other individually identifiable health information) into the Platform, including into free-text fields, uploaded evidence files, or policy documents. To support this obligation, the Platform applies automated checks designed to detect and discourage the submission of obvious PHI values before certain content is processed. These checks are a backstop, not a guarantee; the obligation not to submit PHI is yours, and you are responsible for the content you and your users provide.

Because we do not act as a Business Associate and the Platform is not designed for PHI, we do not sign Business Associate Agreements (BAAs) for use of the Services. If you believe you have inadvertently submitted PHI, please Contact Us so we can help you remove it. We may remove or refuse to process content that appears to contain PHI.

V. Acceptable Use

You agree not to, and not to permit anyone acting through you to:

• upload, enter, or transmit PHI, as described in Section IV;
• use the Platform in violation of any applicable law, or to store or transmit unlawful, infringing, or malicious content;
• attempt to access another organization’s data, circumvent tenant isolation or access controls, or probe, scan, or test the vulnerability of the Platform without our written permission;
• reverse-engineer, decompile, or attempt to derive the source code of the Platform, except to the extent that restriction is prohibited by law;
• resell, sublicense, or provide the Services to third parties outside your organization, or use the Services to build a competing product;
• interfere with or disrupt the integrity or performance of the Platform, or introduce malware, or use automated means to scrape or overload the Services; or
• misrepresent an assessment as a certification or as an independent audit when it is a self-assessment.

We may suspend access to protect the Platform, other customers, or ourselves from harm, and we will restore access once the issue is resolved where practicable.

VI. AI, Slack & Benchmark Features

Some features send limited data outside your tenant. The following describes how they work and matches our Privacy Policy. Where a feature is optional, it is off by default and is controlled by an administrator.

AI features (Anthropic): optional, off by default.

AI-assisted features are off by default. If an administrator enables them for your organization, the specific content needed for the feature (for example, a policy excerpt to tailor, an uploaded report to parse, or assessment context for a suggestion) is sent to our AI subprocessor, Anthropic, to generate a draft or suggestion. AI output is a starting point that you are responsible for reviewing; it is not legal advice and may contain errors. The choice to enable AI is revocable in Settings; with AI off, this content is not sent to Anthropic. Because you agree not to submit PHI (Section IV), the content processed for AI features is your organization’s administrative compliance information.

Slack notifications: optional, off by default.

If an administrator connects your organization’s Slack, review-notification messages (for example, a review opened or resolved) post to your chosen channel. Payloads are minimized and PHI-guarded. With Slack not connected, nothing is sent. You are responsible for your own Slack workspace and its access controls.

Benchmarking: a standard part of the Services.

The Platform shows how your organization’s compliance scores compare to similar organizations (“peers”). This works by contributing your category scores anonymously and only in aggregate to a shared benchmark pool and comparing your scores against it. No individual score is pooled or shown; comparisons appear only when a peer group is large enough, with additional suppression so the numbers cannot single out any organization. Because peer comparison is this contribute-and-compare exchange, it is a standard part of the Services rather than a separate opt-in. The benchmark uses aggregate compliance scores only and does not use PHI or Personal Information.

Peer-approach commons: optional, off by default.

If your organization opts in to data sharing, you may contribute anonymized “how we addressed this” write-ups that other customers can view. Contributions are identity-stripped, and the choice is revocable in Settings. If you have not opted in, nothing you write is shared. Do not include PHI or confidential third-party information in a contribution.

VII. Your Data & Intellectual Property

Your content. As between you and us, you own the content your organization enters or uploads to the Platform (“Customer Data”). You grant us a limited, non-exclusive license to host, process, and use Customer Data solely to provide, secure, and improve the Services, to produce aggregated or de-identified analytics and benchmarks that do not identify you, and as otherwise described in the Privacy Policy. You represent that you have the rights necessary to provide Customer Data and that it does not include PHI.

Our platform. We and our licensors own the Platform, the Services, and all related software, templates, content, and trademarks. Except for the limited right to use the Services under these Terms, no rights are granted to you by implication or otherwise. Compliance templates and materials we provide are licensed to you for use in your own compliance program, not for redistribution.

Feedback. If you send us suggestions or feedback, you grant us a perpetual, royalty-free license to use it to improve the Services, without obligation to you.

VIII. Fees & Billing

Some tiers of the Services are offered free of charge; paid tiers are billed as a subscription for the plan you select. Paid subscriptions are processed by our payment processor, Stripe; you provide your payment details directly to Stripe, and we do not collect or store full payment-card numbers.

• Recurring billing. Unless stated otherwise, paid subscriptions renew automatically for successive periods at the then-current rate until cancelled. Platform Subscription is billed monthly and is month-to-month. Guided Program Development is billed monthly under a quarterly commitment. We do not offer plan discounts. You authorize us and Stripe to charge your payment method for each period.
• Cancellation. You may cancel a subscription through your account or by contacting us. Platform access remains active through the current paid period; Guided access remains active through the applicable paid or commitment boundary. The organization then converts to Free. Customer data and existing readable or exportable records remain available; paid-only new actions are restricted and users above the Free seat limit are suspended rather than deleted. Except where required by law, fees are non-refundable and partial periods are not prorated.
• Changes to fees. We may change fees or introduce new charges on prospective notice; changes take effect at your next renewal.
• Taxes. Fees are exclusive of taxes, and you are responsible for any applicable taxes other than taxes on our net income.
• Guided Program Development. Guided is contact-led and operator-provisioned. The applicable order or statement of work governs its scope and fees.

IX. Disclaimers; Service Provided “As Is”

The Platform and Services are provided “as is” and “as available,” without warranties of any kind, whether express, implied, or statutory, including any implied warranties of merchantability, fitness for a particular purpose, title, and non-infringement. We do not warrant that the Services will be uninterrupted, error-free, or secure, or that any result, assessment, score, benchmark, template, or AI-generated output will be accurate, complete, or suitable for your purpose.

The Services do not constitute legal, medical, or professional advice, and are not a substitute for your own compliance program, professional judgment, or advice of counsel. A HowToHIPAA HIPAA Compliance Assessment is a point-in-time firm attestation based on the evidence reviewed as of the issue date; not a certification, guarantee, or audit. You are solely responsible for your compliance decisions and outcomes. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. Some jurisdictions do not allow the exclusion of certain warranties, so some of the above may not apply to you.

X. Limitation of Liability

To the maximum extent permitted by law, neither party will be liable for any indirect, incidental, special, consequential, or punitive damages, or for any lost profits, revenues, goodwill, or data, arising out of or relating to these Terms or the Services, even if advised of the possibility of such damages.

To the maximum extent permitted by law, our total aggregate liability arising out of or relating to these Terms or the Services will not exceed the amounts you paid to us for the Services in the twelve (12) months before the event giving rise to the claim (or, if you use only free tiers, one hundred U.S. dollars). These limitations apply to all theories of liability and are a fundamental basis of the bargain between us. Some jurisdictions do not allow certain limitations, so some of the above may not apply to you.

XI. Indemnification

You agree to defend, indemnify, and hold harmless HowToHIPAA LLC and its officers, employees, and agents from and against any claims, damages, liabilities, and reasonable expenses (including attorneys’ fees) arising out of or relating to your submission of PHI in breach of Section IV, your other breach of these Terms, your Customer Data, or your misuse of the Services. We will notify you of any such claim, and you will control the defense with counsel of your choosing, provided that any settlement affecting our rights requires our prior written consent.

XII. Term, Termination & Data Return

These Terms apply while you use the Platform. You may stop using the Services and close your account at any time. We may suspend or terminate your access if you materially breach these Terms (including the no-PHI obligation), if required by law, or if we discontinue the Services, with notice where practicable.

Data return and deletion. Before termination, administrators can export your organization’s materials and data through the Platform. After termination, we will delete or de-identify Customer Data within a commercially reasonable period, except where retention is required by law or for legitimate business or security purposes, consistent with the Privacy Policy. Sections that by their nature should survive termination (including Sections VII–XI and XIII) will survive.

XIII. Governing Law

These Terms and any dispute arising out of or relating to them or the Services are governed by the laws of the State of New York, without regard to its conflict-of-laws principles. This matches the governing law of our Privacy Policy. The parties submit to the exclusive jurisdiction of the state and federal courts located in New York for any dispute not otherwise subject to an agreed dispute-resolution process.

XIV. Changes to these Terms

We may update these Terms to reflect changes in the Services, the law, or our practices. We will post the updated Terms here with a revised “last updated” date, and for material changes we will provide additional notice (for example, by e-mail to your account address or a notice in the Platform). Your continued use of the Platform after an update takes effect means you accept the updated Terms.

XV. Contact Us

If you have any questions about these Terms, contact us at [email protected] or 175 Stockholm St STE 101, Brooklyn, NY 11237, or through the Contact Us page on the Platform.