Protected health information
SuiteDash and HIPAA
SuiteDash is HIPAA-capable, not HIPAA-by-default. If you are a Covered Entity or Business Associate, request and execute a Business Associate Agreement (BAA) with SuiteDash before you store, transmit or process protected health information (PHI) in the service.
Your BAA and the way you configure the account both matter. A portal subscription or feature toggle alone does not establish compliance for your organization.
Execute the BAA before PHI use
The current Privacy Policy, section 5 and Terms of Service, section 2.4 state the same prerequisite: a customer intending to handle PHI must first execute a BAA with SuiteDash. Without an executed BAA, do not upload, send or process PHI through SuiteDash. The executed BAA governs its covered PHI handling.
To request the agreement, contact SuiteDash and explain your intended PHI workflow before rollout.
Review who can see each record
Plan access by Staff Role, Client, Circle and shared resource. The Files visibility guide explains the available file and folder controls. Two Factor Authentication adds a sign-in step and can be required for selected users. Test a representative Staff and Client account before you place PHI into a production workflow.
Check login and notification settings
Privacy Mode keeps message text out of email notifications by default. Convenience Mode includes message text in email, and the Help guidance warns against enabling it for information that must meet privacy requirements. Review any configured templates and delivery paths before sending PHI.
Understand the security and data terms
The Privacy Policy describes encryption in transit and at rest, access controls, audit logging and the use of Amazon Web Services as a cloud infrastructure subprocessor. It also describes account data retention and residual copies in routine backups. The Security Overview connects these policies to account settings and service status.
The privacy policy states that no electronic transmission or storage method is completely secure. Your organization remains responsible for its own HIPAA analysis, workforce practices and account configuration under the Terms and its executed BAA.
A practical review sequence
- Identify whether your planned content includes PHI and which users need it.
- Request and execute the BAA before any PHI enters SuiteDash.
- Configure access, Two Factor Authentication, message settings and login options.
- Test the client and Staff views with non-PHI sample data.
- Review the current Privacy Policy, Terms and your executed BAA with your own compliance team.
Planning a PHI workflow?
Describe your organization and intended use when you request the BAA. Confirm the agreement and settings before uploading any PHI.
