HIPAA & BAA

Last updated: June 21, 2026

Our Approach to HIPAA

Emerald Wellness is committed to supporting practitioner-tier subscribers with appropriate health-data safeguards and contractual controls. For individual consumers using Emerald Wellness for personal health tracking, HIPAA may not apply in the same way it applies to covered healthcare providers, health plans, and their business associates; individual consumer data is governed by our Privacy Policy and applicable consumer privacy laws.

For covered healthcare providers and practitioners who use our platform to manage client health information, Emerald Wellness can act as a Business Associate only after a written Business Associate Agreement (BAA) is completed.

Who Needs a BAA

You need a BAA with Emerald Wellness if you are:

• A covered entity under HIPAA (licensed healthcare provider, health plan, or healthcare clearinghouse)
• Using our platform to store, process, or transmit Protected Health Information (PHI) on behalf of your patients or clients
• A Pro Practitioner Suite subscriber using client profile features

What We Cover

Under our BAA, Emerald Wellness agrees to:

• Use and disclose PHI only as permitted under the agreement and applicable law
• Implement appropriate safeguards to protect PHI
• Report any breach of unsecured PHI to the covered entity
• Ensure that subcontractors who handle PHI agree to the same restrictions
• Return or destroy PHI upon termination of the agreement
• Make PHI available for access, amendment, and accounting of disclosures as required

Security Safeguards

Emerald Wellness implements the following technical and administrative safeguards:

• Encryption: Production systems should use encryption in transit and at rest through vetted infrastructure providers
• Access controls: Role-based access and least-privilege account permissions should be configured before PHI is stored
• Audit logging: Access to PHI should be logged and auditable for covered workflows
• Data isolation: Client health records should be isolated by authorized practitioner account
• Breach notification: We will notify you within 60 days of discovering a breach affecting your PHI

Individual Consumers

If you are an individual using Emerald Wellness for personal health tracking and not through a covered healthcare provider, your data is governed by our Privacy Policy and applicable consumer privacy laws. HIPAA determinations can be fact-specific, so this page is informational only.

Request a BAA

To request a Business Associate Agreement, contact us:

• Email: hipaa@emeraldwellness.health
• Mail: Emerald Wellness, LLC, Columbus, Ohio
• Phone: 216-616-8995

Please include your full name, practice name, NPI number (if applicable), and the email address associated with your Emerald Wellness account.

This page does not constitute legal advice. Consult a healthcare attorney for guidance specific to your HIPAA compliance obligations.