HIPAA — Health Insurance Portability and Accountability Act
What is HIPAA?
HIPAA is the US federal law (45 CFR Part 164, especially the Security Rule at §164.302 and the Privacy Rule) that governs how protected health information is created, stored, and transmitted. On a CPaaS platform it binds the moment a healthcare tenant sends any message, call, or fax that contains patient information: the platform is a business associate, the tenant is a covered entity, and both owe protected health information (PHI) the access, encryption, retention, and audit controls the Security Rule lists.
More detail
PHI is any individually identifiable health information — diagnoses, treatment dates, prescriptions, appointment confirmations, lab results — paired with an identifier like a name, phone number, or IP address. A bare phone number is not PHI, but a phone number queued for an appointment reminder with a treatment date attached is; the pairing is the threshold that brings HIPAA in scope.
A communications platform joins the PHI chain because of how care coordination works in practice: SMS appointment reminders, IVR callbacks that read out a result or reschedule a visit, clinical fax delivered over T.38, and voice calls recorded for quality purposes can all carry PHI. Each one gives the platform a moment where it is creating, receiving, maintaining, or transmitting PHI on the tenant's behalf — precisely the business-associate relationship HIPAA describes.
That relationship is documented in a Business Associate Agreement (BAA). Under 45 CFR §164.504(e) a covered entity may not share PHI with a vendor absent a BAA that describes the vendor's permitted uses, safeguards, and breach-reporting duties; without it the vendor relationship itself is an impermissible disclosure. Orbit applies that constraint at send time: a tenant that has not executed an in-term BAA is blocked from sending until execution clears — the send gate fails closed rather than defaulting to permissive.
When the BAA is in place, HIPAA mode on a tenant turns on the shipped controls: every PHI read is written to a reason-coded audit log, PHI-containing content is encrypted at rest and in transit, retention windows auto-delete after a configured period, and workspace roles that touch PHI (owner/admin/developer/viewer) are separated from the billing role, which cannot read message content at all. Disabling HIPAA mode requires re-authentication before access is restored — the re-auth is not cosmetic; it is the guard that prevents a session hijack from undoing the trade-audit trail.
Frequently asked
- Is a tenant that responds 'we never store diagnoses' still in scope for HIPAA?
- Yes, often. HIPAA does not require the tenant to recognize PHI for it to apply — a bare appointment time attached to a patient name, or a callback number a patient left on an inbound voicemail, already crosses the threshold. The safest tenant posture is to assume every patient-linked identifier transits the platform until the PHI-audience inventory that maps email/phone/device destinations says otherwise.
- What is a Business Associate Agreement (BAA) and why does Orbit require one?
- A BAA is the contract HIPAA says must exist before a covered entity may hand PHI to a vendor. It lays out what the vendor may do with the PHI, the safeguards it must run, and its breach-notification duties. Without one the sharing itself is a violation; with one the vendor becomes a business associate and the tenant may lawfully pass PHI. Orbit's send gate checks the executed BAA status at send time and returns 422 HIPAA_BAA_REQUIRED with the BAA's reason when it is not in term.
- Does HIPAA stop at SMS reminders, or does it cover voice and fax too?
- Voice and fax carry the same PHI obligations: an IVR callback that discloses a lab result, a recorded call with a patient complaint, or a T.38 fax of a clinical document all create PHI moments. Orbit applies the controls channel-agnostically because the HIPAA statute is channel-agnostic — what matters is whether the content qualifies as PHI, not which pipe it crossed.
- What happens when HIPAA mode is disabled?
- Disabling HIPAA mode re-opens PHI reads and stops the PHI-access audit log from covering that workspace. Orbit treats this as a privileged re-authentication step — the requesting operator must re-auth before the mode disables, just as enabling required the BAA to execute. The control is deliberately harder to undo than to set, matching the asymmetric-risk profile of PHI.
See also
Build it on Orbit
Voice, messaging, email, video, and AI agents on one platform and one pay-as-you-go bill. Start free — no credit card required.