# Security basics

> Know how Tabflows protects patient data, where your clinic's BAA is, and the habits that keep PHI safe.

Markdown view of https://www.tabflows.com/university/tabflows-101/security-basics — the HTML page is canonical.

Tabflows 101, Module 9 · Admin track 4 min · Team track 3 min

Know how Tabflows protects patient data, where your clinic's BAA is, and the habits that keep PHI safe.

Tabflows handles protected health information (PHI) as a HIPAA Business Associate. Your clinic's data is encrypted in transit and, in Tabflows' core data stores, at rest. It is kept separate from every other clinic's and never sold, and Tabflows never stores the logins to your healthcare systems.

The standard BAA applies automatically to covered entities and healthcare organizations using Tabflows; whoever signed up your clinic accepted it. Your clinic still owns its own HIPAA duties: your policies, who has access, and what your staff sends.

## Topics

### Answer "Is Tabflows HIPAA-compliant?"

Tabflows works as a HIPAA Business Associate, and its standard BAA applies to your clinic automatically; whoever signed up your clinic accepted it. Clinic data is encrypted in transit and, in Tabflows' core data stores, at rest, kept separate from other clinics, never sold, and not used to train generalized or cross-customer AI models.

- [Tabflows healthcare security standards](https://www.tabflows.com/university/library/security-and-privacy/tabflows-healthcare-security-standards)
  Markdown: https://www.tabflows.com/university/library/security-and-privacy/tabflows-healthcare-security-standards.md
- [How Tabflows protects your data](https://www.tabflows.com/university/library/security-and-privacy/how-tabflows-protects-your-data)
  Markdown: https://www.tabflows.com/university/library/security-and-privacy/how-tabflows-protects-your-data.md
- [How Tabflows handles patient data](https://www.tabflows.com/university/library/security-and-privacy/how-tabflows-handles-patient-data)
  Markdown: https://www.tabflows.com/university/library/security-and-privacy/how-tabflows-handles-patient-data.md

### Never hand over a system password

Tabflows works through the logins you already have in your own browser. It never requires or stores credentials for your healthcare systems.

- [How Tabflows protects your data](https://www.tabflows.com/university/library/security-and-privacy/how-tabflows-protects-your-data)
  Markdown: https://www.tabflows.com/university/library/security-and-privacy/how-tabflows-protects-your-data.md

### Do your part with patient information

Your prompts, Sidekick chats and drafts are treated as patient information. Your clinic still decides who has access and what gets sent.

1. Include only the patient details a request needs, in Sidekick and in Team Chat.
2. Follow each action's review step, and check consequential results in the source system.

- [How Tabflows handles patient data](https://www.tabflows.com/university/library/security-and-privacy/how-tabflows-handles-patient-data)
  Markdown: https://www.tabflows.com/university/library/security-and-privacy/how-tabflows-handles-patient-data.md
- [Tabflows healthcare security standards](https://www.tabflows.com/university/library/security-and-privacy/tabflows-healthcare-security-standards)
  Markdown: https://www.tabflows.com/university/library/security-and-privacy/tabflows-healthcare-security-standards.md
- [Use Team Chat to coordinate clinic work](https://www.tabflows.com/university/library/team-chat/use-team-chat-to-coordinate-clinic-work)
  Markdown: https://www.tabflows.com/university/library/team-chat/use-team-chat-to-coordinate-clinic-work.md

### Handle a security review or BAA question (Admin track)

There's no BAA to request: the current one is at tabflows.com/baa. Your clinic stays responsible for its own policies, access and what staff send.

1. Point anyone asking about the agreement to tabflows.com/baa.
2. Email security@tabflows.com for security documentation, a completed questionnaire, or the current subprocessor list.
3. Archive people who leave (**Admin → Team**, **Archive user**) so access matches your team.

- [Tabflows healthcare security standards](https://www.tabflows.com/university/library/security-and-privacy/tabflows-healthcare-security-standards)
  Markdown: https://www.tabflows.com/university/library/security-and-privacy/tabflows-healthcare-security-standards.md
- [HIPAA-compliant. No migration. No IT setup.](https://www.tabflows.com/university/library/security-and-privacy/hipaa-compliant-no-migration-no-it-setup)
  Markdown: https://www.tabflows.com/university/library/security-and-privacy/hipaa-compliant-no-migration-no-it-setup.md
- [How to archive a team member](https://www.tabflows.com/university/library/admin-and-settings/how-to-archive-a-team-member)
  Markdown: https://www.tabflows.com/university/library/admin-and-settings/how-to-archive-a-team-member.md

## Read
- [Tabflows healthcare security standards](https://www.tabflows.com/university/library/security-and-privacy/tabflows-healthcare-security-standards)
  Markdown: https://www.tabflows.com/university/library/security-and-privacy/tabflows-healthcare-security-standards.md
- [How Tabflows protects your data](https://www.tabflows.com/university/library/security-and-privacy/how-tabflows-protects-your-data)
  Markdown: https://www.tabflows.com/university/library/security-and-privacy/how-tabflows-protects-your-data.md
- [How Tabflows handles patient data](https://www.tabflows.com/university/library/security-and-privacy/how-tabflows-handles-patient-data)
  Markdown: https://www.tabflows.com/university/library/security-and-privacy/how-tabflows-handles-patient-data.md
- [Get a Business Associate Agreement (BAA) with Tabflows](https://www.tabflows.com/baa)
  Markdown: https://www.tabflows.com/baa.md

## Do it in Tabflows (Admin track)

Check the parts your clinic owns.

1. Read the BAA at [tabflows.com/baa](https://www.tabflows.com/baa) and save a copy to your compliance file.
2. Open **Team** under **Admin** and check that everyone listed still works at your clinic, with the right **Permissions**.
3. If you are an Admin, select **Archive user** for anyone who has left.
4. Check that your phone locks with a passcode, Face ID or fingerprint, and sign out of Tabflows on any shared device.
5. Before you send or chart a Sidekick answer, check the patient, dates, medications and sources against the record.

## Check your security basics (Team track)

1. Read the current BAA at tabflows.com/baa.
2. Confirm nobody on your team has given a system password to Tabflows.
3. Before sending or charting a Sidekick or Magic Button result, check it in the source system.
4. Save security@tabflows.com for security questions.

## Related markdown

Alongside this page:

- [Automations](https://www.tabflows.com/university/tabflows-101/automations.md)
- [Magic buttons](https://www.tabflows.com/university/tabflows-101/magic-buttons.md)
- [Mobile](https://www.tabflows.com/university/tabflows-101/mobile.md)
- [Practice brain](https://www.tabflows.com/university/tabflows-101/practice-brain.md)
- [Set up your clinic](https://www.tabflows.com/university/tabflows-101/set-up-your-clinic.md)
- [Sidekick](https://www.tabflows.com/university/tabflows-101/sidekick.md)
- [Tasks](https://www.tabflows.com/university/tabflows-101/tasks.md)
- [Team chat](https://www.tabflows.com/university/tabflows-101/team-chat.md)

Start here:

- [Tabflows](https://www.tabflows.com/index.md)
- [Tabflows pricing](https://www.tabflows.com/pricing.md)
- [Tabflows FAQ](https://www.tabflows.com/faqs.md)
- [About Tabflows](https://www.tabflows.com/about.md)
- [Contact Tabflows](https://www.tabflows.com/contact.md)
- [DPC workflow software](https://www.tabflows.com/dpc-workflow-software.md)
- [Directory](https://www.tabflows.com/directory.md)
- [Workflows](https://www.tabflows.com/workflows.md)
- [DPC finder](https://www.tabflows.com/dpc-finder.md)

Every page listed in sitemap.xml has a markdown twin at the same URL with `.md` appended, or by sending `Accept: text/markdown` to the canonical URL. Wider index: [llms.txt](https://www.tabflows.com/llms.txt), [llms-full.txt](https://www.tabflows.com/llms-full.txt), [sitemap.md](https://www.tabflows.com/sitemap.md), [sitemap.xml](https://www.tabflows.com/sitemap.xml). Support documentation: https://www.tabflows.com/university/library — append `.md` to any article URL for its raw markdown.