Tabflows healthcare security standards
On this page
Is Tabflows HIPAA-compliant?
Tabflows handles protected health information (PHI) as a Business Associate — the HIPAA term for a vendor that handles patient data for a healthcare provider and takes on its own legal obligations to protect it.
Two more things matter here. Tabflows never asks for or stores passwords for your healthcare systems. And Tabflows prepares drafts and actions, while a person on your team reviews or approves them before anything goes to a patient.
Do I need to request a BAA?
No. The standard Tabflows BAA applies automatically to covered entities and healthcare organizations using the service, so no separate request is required.
During signup, the person creating your clinic's account confirms they have the authority to accept the current agreement on behalf of the clinic.
Do you sell my data?
No. Tabflows does not sell or monetize patient data, and your clinic's data is partitioned from every other customer's.
Where do I find the details?
- Get a Business Associate Agreement (BAA) with Tabflows — how the BAA applies, and what it covers.
- Get HIPAA-compliant automation with Tabflows — the safeguards program behind Sidekick and Magic Buttons.
- How Tabflows protects your data — encryption, hosting, partitioning, and why there is no password to hand over.
- How Tabflows handles patient data — what happens when AI features touch PHI.
What am I responsible for?
Your organization remains responsible for its own HIPAA obligations — your policies, who has access, and what your staff sends.
Where do I send a security review?
Email security@tabflows.com for security documentation, a questionnaire, or a current subprocessor list.
Get support 💬
Need help or have a question? Reach out to our Support team however works best for you:
- Start a chat using the Support button at the bottom right of the sidebar (side tabs)
- Email us at team@tabflows.com or