What does the HIPAA/BAA checklist cover?

Five tenant-owned steps that make up a HIPAA-ready posture on Orbit: attesting whether PHI is in scope, executing the Business Associate Agreement, the workspace owner's HIPAA mode toggle, role-based PHI access (who can read message content and the PHI audit log), and the minimum-necessary audit row with reason codes.

Does Orbit decide whether my traffic is HIPAA-regulated?

No. HIPAA posture is tenant-owned: you attest whether PHI is in scope, and Orbit's send-time gate rejects PHI traffic with HIPAA_BAA_REQUIRED until a BAA is executed. Orbit supplies the e-sign pipeline and the enforcement point; the legal determination is yours to make with counsel.

How long does an executed BAA stay valid?

An executed BAA runs a one-year term. When it expires, PHI sends gate again until you re-execute, and re-execution becomes available 60 days before expiry. The BAA status endpoint reports the countdown so your compliance owner can schedule the renewal.

HIPAA/BAA readiness checklist

Self-assess the five tenant-owned steps — PHI-scope attestation, BAA execution, the HIPAA mode toggle, role-based PHI access, and the minimum-necessary audit row. Free, no sign-up.

HIPAA/BAA readiness checklist

Mark the steps you already have covered and see the posture in plain language. Each step is a control Orbit ships as a tenant-operated setting — this page advises, it never enforces.

PHI-scope attestationDeclare whether Protected Health Information enters your traffic. The attestation starts (or relaxes) the BAA lifecycle — 'not_required' is the default until you attest otherwise.Flipping `hipaa_required` on moves the BAA lifecycle to pending automatically, so the execute step opens without a separate call.Docs: Business Associate Agreement (BAA) flow →
BAA executionA workspace owner signs the Business Associate Agreement — template preview, typed-name e-signature, and a stored executed PDF. Send-time gates reject PHI traffic with HIPAA_BAA_REQUIRED until it is executed.Only 'executed' satisfies the HIPAA-enable and PHI-send gates. The agreement runs a one-year term; re-execution opens 60 days before expiry.Docs: Business Associate Agreement (BAA) flow →
HIPAA mode toggleThe workspace owner turns HIPAA mode on per organization — opt-in, off by default, BAA-gated, and disable requires re-authentication.HIPAA mode activates (or relaxes) the enhanced control set; the roles-versus-surface matrix in the HIPAA docs shows who can flip it.Docs: HIPAA compliance controls →
Role-based PHI accessMessage-content and PHI audit-log reads are restricted to designated roles — owners and admins read content; developers and viewers do not touch the PHI access log; billing roles read neither.The HIPAA docs carry the roles-versus-surface matrix per surface — map each control to the people in your workspace before go-live.Docs: HIPAA compliance controls →
Minimum-necessary & PHI auditEvery PHI read is logged with a reason code so you can prove minimum-necessary access, and the rolling audit row lines up with the PHI-channel matrix that keeps PHI out of channels it should never use.The PHI audit row rolls up to the DPA processing-records catalog; the PHI channel matrix in the HIPAA docs names which channel surfaces are PHI-eligible.Docs: HIPAA compliance controls →

0 / 5 steps covered

None of the five posture steps are marked covered. HIPAA posture is tenant-owned — each step below is a control you operate, and the checklist names its docs page.

HIPAA posture is tenant-owned: Orbit supplies the BAA e-sign pipeline and the send-time gate — the legal determination that PHI is in scope is yours, and nothing on this page enforces or verifies it. This checklist is not legal advice — confirm your HIPAA obligations with counsel.

Frequently asked questions

What does the HIPAA/BAA checklist cover?: Five tenant-owned steps that make up a HIPAA-ready posture on Orbit: attesting whether PHI is in scope, executing the Business Associate Agreement, the workspace owner's HIPAA mode toggle, role-based PHI access (who can read message content and the PHI audit log), and the minimum-necessary audit row with reason codes.
Does Orbit decide whether my traffic is HIPAA-regulated?: No. HIPAA posture is tenant-owned: you attest whether PHI is in scope, and Orbit's send-time gate rejects PHI traffic with HIPAA_BAA_REQUIRED until a BAA is executed. Orbit supplies the e-sign pipeline and the enforcement point; the legal determination is yours to make with counsel.
How long does an executed BAA stay valid?: An executed BAA runs a one-year term. When it expires, PHI sends gate again until you re-execute, and re-execution becomes available 60 days before expiry. The BAA status endpoint reports the countdown so your compliance owner can schedule the renewal.

More free tools

See the full developer tools hub — SMS cost calculator, E.164 formatter, carrier/line-type checker, RCS reach checker, 10DLC throughput calculator, TCPA quiet-hours checker, and TCPA compliance checklist.

Start free