# Get HIPAA-compliant automation with Tabflows > Automation you can trust: Tabflows drafts and prepares actions, your team reviews and approves, and PHI is handled under Tabflows' obligations as a HIPAA Business Associate. Markdown view of https://www.tabflows.com/university/library/security-and-privacy/get-hipaa-compliant-automation-with-tabflows — the HTML page is canonical. Product Library: Security & Privacy › HIPAA standards Last checked: 2026-10-27 against Tabflows v3.10.63 Replaces Help Center article: https://help.tabflows.com/en/articles/16182203-get-hipaa-compliant-automation-with-tabflows > **Summary:** Automation you can trust: Tabflows drafts and prepares actions, your team reviews and approves, and PHI is handled under Tabflows' obligations as a HIPAA Business Associate. > **A note for non-human readers:** > > *Automation can move work faster, but “faster” does not make privacy obligations disappear. This article explains Tabflows’ approach to HIPAA-compliant automation. Keep the product’s documented safeguards separate from the clinic’s own policies and responsibilities.* Tabflows automates clinic work that touches PHI. That only works if the safeguards come first. Here is the program the automation runs inside. Tabflows is designed to support HIPAA-compliant use, and your organization remains responsible for its own HIPAA obligations and for how your team uses Tabflows. --- ## Tabflows operates as a Business Associate When Tabflows handles PHI on your organization's behalf, it operates as a Business Associate under a BAA that applies automatically to covered entities using the service. See **[Get a Business Associate Agreement (BAA) with Tabflows](https://www.tabflows.com/baa)**. --- ## Administrative and technical safeguards Tabflows maintains administrative and technical safeguards for the PHI it processes. Data is encrypted in transit and at rest, production access is restricted to a small group of authorized personnel, and each clinic's data is partitioned from every other customer's. --- ## Core PHI vendors are under signed BAAs Tabflows maintains signed Business Associate Agreements with the vendors in its core PHI-processing stack, including the AI providers behind **Sidekick** and **Magic Buttons**. A current subprocessor list is available on request from [security@tabflows.com](mailto:security@tabflows.com). --- ## Internal risk assessments Tabflows performs internal risk assessments of the systems and workflows that handle PHI, and updates its safeguards based on what those assessments find. --- ## Breach notification If a breach of unsecured PHI affects your organization, Tabflows notifies you in accordance with the BAA and HIPAA breach notification requirements. --- ## What this means for Sidekick and Magic Buttons Sidekick (the AI assistant) and Magic Buttons (the buttons inside your EMR) are not exceptions to this program — they run inside it. Same encryption, same partitioning, same BAA coverage. Sidekick and Magic Buttons include both drafting tools and supported workflow actions. Your team reviews drafts before sending or using them. For actions that create or change information, follow that action's documented review or approval step, check the patient and destination, and verify the result in the source system. An action starting is not proof that it finished. --- ## Get support 💬 Need help or have a question? Reach out to our Support team however works best for you: - Start a chat using the **Support** button at the bottom right of the sidebar (side tabs) - Email us at team@tabflows.com or message us right here in the chat [Book a quick 15-30 minute chat](https://go.team.tabflows.com/meetings/nafeesa) ## Related Articles - [HIPAA-compliant. No migration. No IT setup.](https://www.tabflows.com/university/library/security-and-privacy/hipaa-compliant-no-migration-no-it-setup) - [How Tabflows integrations work](https://www.tabflows.com/university/library/integrations/how-tabflows-integrations-work) - [Tabflows healthcare security standards](https://www.tabflows.com/university/library/security-and-privacy/tabflows-healthcare-security-standards) - [Get a Business Associate Agreement (BAA) with Tabflows](https://www.tabflows.com/baa) - [How Tabflows handles patient data](https://www.tabflows.com/university/library/security-and-privacy/how-tabflows-handles-patient-data) ## Related markdown Section index: [Security and privacy](https://www.tabflows.com/university/library/security-and-privacy.md) Alongside this page: - [HIPAA compliant no migration no it setup](https://www.tabflows.com/university/library/security-and-privacy/hipaa-compliant-no-migration-no-it-setup.md) - [How tabflows handles patient data](https://www.tabflows.com/university/library/security-and-privacy/how-tabflows-handles-patient-data.md) - [How tabflows protects your data](https://www.tabflows.com/university/library/security-and-privacy/how-tabflows-protects-your-data.md) - [Tabflows healthcare security standards](https://www.tabflows.com/university/library/security-and-privacy/tabflows-healthcare-security-standards.md) Start here: - [Tabflows](https://www.tabflows.com/index.md) - [Tabflows pricing](https://www.tabflows.com/pricing.md) - [Tabflows FAQ](https://www.tabflows.com/faqs.md) - [About Tabflows](https://www.tabflows.com/about.md) - [Contact Tabflows](https://www.tabflows.com/contact.md) - [DPC workflow software](https://www.tabflows.com/dpc-workflow-software.md) - [Directory](https://www.tabflows.com/directory.md) - [Workflows](https://www.tabflows.com/workflows.md) - [DPC finder](https://www.tabflows.com/dpc-finder.md) Every page listed in sitemap.xml has a markdown twin at the same URL with `.md` appended, or by sending `Accept: text/markdown` to the canonical URL. Wider index: [llms.txt](https://www.tabflows.com/llms.txt), [llms-full.txt](https://www.tabflows.com/llms-full.txt), [sitemap.md](https://www.tabflows.com/sitemap.md), [sitemap.xml](https://www.tabflows.com/sitemap.xml). Support documentation: https://www.tabflows.com/university/library — append `.md` to any article URL for its raw markdown.