Security basics
Know how Tabflows protects patient data, where your clinic's BAA is, and the habits that keep PHI safe.
Tabflows handles protected health information (PHI) as a HIPAA Business Associate. Your clinic's data is encrypted in transit and, in Tabflows' core data stores, at rest. It is kept separate from every other clinic's and never sold, and Tabflows never stores the logins to your healthcare systems.
The standard BAA applies automatically to covered entities and healthcare organizations using Tabflows; whoever signed up your clinic accepted it. Your clinic still owns its own HIPAA duties: your policies, who has access, and what your staff sends.
Topics
Answer "Is Tabflows HIPAA-compliant?" Tabflows works as a HIPAA Business Associate, and its standard BAA applies to your clinic automatically; whoever signed up your clinic accepted it. Clinic data is encrypted in transit and, in Tabflows' core data stores, at rest, kept separate from other clinics, never sold, and not used to train generalized or cross-customer AI models.
Never hand over a system password Tabflows works through the logins you already have in your own browser. It never requires or stores credentials for your healthcare systems.
More detail
Do your part with patient information Your prompts, Sidekick chats and drafts are treated as patient information. Your clinic still decides who has access and what gets sent.
- Include only the patient details a request needs, in Sidekick and in Team Chat.
- Follow each action's review step, and check consequential results in the source system.
Handle a security review or BAA question There's no BAA to request: the current one is at tabflows.com/baa. Your clinic stays responsible for its own policies, access and what staff send.
- Point anyone asking about the agreement to tabflows.com/baa.
- Email security@tabflows.com for security documentation, a completed questionnaire, or the current subprocessor list.
- Archive people who leave (Admin → Team, Archive user) so access matches your team.
Do it in Tabflows
Check the parts your clinic owns.
- Read the BAA at tabflows.com/baa and save a copy to your compliance file.
- Open Team under Admin and check that everyone listed still works at your clinic, with the right Permissions.
- If you are an Admin, select Archive user for anyone who has left.
- Check that your phone locks with a passcode, Face ID or fingerprint, and sign out of Tabflows on any shared device.
- Before you send or chart a Sidekick answer, check the patient, dates, medications and sources against the record.
Do it in Tabflows
Check your security basics.
- Read the current BAA at tabflows.com/baa.
- Confirm nobody on your team has given a system password to Tabflows.
- Before sending or charting a Sidekick or Magic Button result, check it in the source system.
- Save security@tabflows.com for security questions.