Is SOAPsuds HIPAA compliant?

The Business Associate Agreement (BAA)

HIPAA calls for a BAA between your practice and SOAPsuds, because SOAPsuds handles your patients’ information. Who accepts it depends on how you use SOAPsuds:

• A clinician on their own accepts it for themselves, when they sign up or on the screen that asks for it after sign-in. Settings›Account then shows when you accepted it and which version, with a BAA record button.
• A practice admin accepts it once for the whole practice. It covers every clinician and staff member the practice adds, so they never accept one themselves. Settings›Practice shows who accepted it and when.
• A practice SOAPsuds set up has its BAA in its contract with SOAPsuds, so nobody accepts it in the app.

The BAA record lists each acceptance: who accepted it, for whom, the version, the date and time, how, the IP address and the browser. You can print it or save it as a PDF. SOAPsuds keeps each acceptance for at least 6 years, even if the account or practice is deleted.

How your patients’ information is protected

• Encryption. Visit records, including the audio, are stored encrypted. A visit recorded without a connection is kept encrypted on your device until it uploads.
• 30-day deletion. Each visit’s audio, transcript and note are deleted 30 days after the visit. You can delete a visit sooner.
• Access log. Settings›Activity records every sign-in and everyone who opened, changed, copied or downloaded a visit, SOAPsuds support included. It is kept at least 6 years and can’t be edited. For one visit, open it and choose Access history.
• Automatic sign-out. SOAPsuds signs you out after an hour without activity.
• Limited access in a practice. Clinicians see their own visits. By default a practice admin doesn’t see note text, and office staff see referrals only.

Need a signed copy?

Need a copy signed by SOAPsuds, or have your own BAA form? Email support@soapsuds.io. Don’t put patient details in the email.