HIPAA at Citation
Safeguards and contractual requirements for approved workflows involving protected health information.
Scope at a glance.
- Framework
- HIPAA
- Status
- Compliant
- Applies to
- Only the agreed healthcare workflow, approved features and services covered by the applicable agreements.
Read this alongside the security controls and provider list for the features you plan to use.
Start with the intended workflow
Citation supports HIPAA compliance requirements for the agreed service scope. Before using protected health information, discuss the intended workflow, required safeguards and the applicable business associate agreement with us.
HIPAA compliance is a combination of responsibilities, agreements, configuration and practice. A general product account does not by itself establish a business associate agreement or make every connected service suitable for protected health information.
Understand where content is processed
Writing assistance, checks, voice features and external integrations can send content to processing providers. Review which features and providers are included in your approved arrangement before enabling them for a sensitive workflow.
Document permissions and sharing also matter. Limit access to authorized people and avoid public links for protected information. Review the security and privacy information alongside your own organizational policies.
Discuss requirements before uploading
Contact us with a description of the use case and the features you need. Do not include patient records or other protected health information in the initial inquiry. We can discuss the appropriate scope, agreements and next steps.
Documents for a useful review.
Ask for the information that establishes the relevant scope, period and responsibilities.
- Applicable business associate agreement
- Approved feature, provider and data flow scope
- Administrative, physical and technical safeguard information
- Incident reporting and retention responsibilities
Include your organization, intended workflow and procurement requirements when requesting access. Some documents may require confidentiality arrangements.
Your part in the workflow.
- Confirm the approved scope before uploading protected health information.
- Restrict access and avoid public document links for protected information.
- Exclude unapproved AI, email, voice or integration paths from the workflow.
For personal information requests, use Data requests. For a suspected incident, follow the security reporting process.