HIPAA & BAA

Last updated: May 25, 2026

Our Approach to HIPAA

Emerald Wellness is committed to supporting our practitioner-tier subscribers in meeting their HIPAA obligations. For individual consumers using our platform for personal health tracking, Emerald Wellness operates as a personal health record (PHR) platform, which is generally not subject to HIPAA's Privacy Rule when data is collected directly from the individual.

For healthcare providers and practitioners who use our platform to manage client health information, Emerald Wellness acts as a Business Associate and provides a Business Associate Agreement (BAA) upon request.

Who Needs a BAA

You need a BAA with Emerald Wellness if you are:

• A covered entity under HIPAA (licensed healthcare provider, health plan, or healthcare clearinghouse)
• Using our platform to store, process, or transmit Protected Health Information (PHI) on behalf of your patients or clients
• A Practitioner Intelligence subscriber using client profile features

What We Cover

Under our BAA, Emerald Wellness agrees to:

• Use and disclose PHI only as permitted under the agreement and applicable law
• Implement appropriate safeguards to protect PHI
• Report any breach of unsecured PHI to the covered entity
• Ensure that subcontractors who handle PHI agree to the same restrictions
• Return or destroy PHI upon termination of the agreement
• Make PHI available for access, amendment, and accounting of disclosures as required

Security Safeguards

Emerald Wellness implements the following technical and administrative safeguards:

• Encryption: All data is encrypted in transit (TLS 1.2+) and at rest (AES-256)
• Access controls: Role-based access, multi-factor authentication support
• Audit logging: Access to health records is logged and auditable
• Data isolation: Client health records are isolated per practitioner account
• Breach notification: We will notify you within 60 days of discovering a breach affecting your PHI

Individual Consumers

If you are an individual using Emerald Wellness for personal health tracking (not a healthcare provider), your data is governed by our Privacy Policy. Personal health records created and managed directly by the individual are generally exempt from HIPAA's Privacy Rule under the PHR exemption.

Request a BAA

To request a Business Associate Agreement, contact us:

• Email: hipaa@emeraldwellness.health
• Mail: Emerald Wellness, Inc., 470 West Broad St, Ste 1062, Columbus, Ohio 43215
• Phone: 216-616-8995

Please include your full name, practice name, NPI number (if applicable), and the email address associated with your Emerald Wellness account.

This page does not constitute legal advice. Consult a healthcare attorney for guidance specific to your HIPAA compliance obligations.