> For the complete documentation index, see [llms.txt](https://docs.simplespa.net/simplespa-documentation/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.simplespa.net/simplespa-documentation/extras/faq/simplespa-hipaa.md).

# SimpleSpa HIPAA

How SimpleSpa protects ePHI and when you need a Business Associate Agreement (BAA) under HIPAA.

SimpleSpa supports customers who are subject to HIPAA. If you plan to use SimpleSpa with Protected Health Information (PHI), you must request a Business Associate Agreement (BAA) first.

## Our security practices

At SimpleSpa, we are dedicated to six security best practices for protecting electronic protected health information (ePHI) and credit card data. These include, but are not limited to:

* Maintaining a secure network
* Encrypting and protecting ePHI and cardholder data
* Maintaining a Vulnerability Management and Assessment Program
* Implementing strong access control measures
* Monitoring and testing production and development networks
* Maintaining a thorough internal information security program and policies

## Business Associate Agreement (BAA)

SimpleSpa supports customers who are subject to the requirements of the Health Insurance Portability and Accountability Act (HIPAA). Under HIPAA, certain information about a person’s health or health care services is classified as Protected Health Information (PHI). If You are subject to HIPAA and wish to use Our Services with PHI, it is Your responsibility to request a Business Associate Agreement (“BAA”) with SimpleSpa. You are solely responsible for determining whether You are subject to HIPAA requirements. If You are subject to HIPAA and have not entered into a BAA, You must not use any of Our digital properties in connection with PHI. You agree to indemnify, defend, and hold harmless SimpleSpa and its directors, employees, and affiliates against any claim relating to a failure by You to request a BAA with [SimpleSpa](https://www.simplespa.com/).

## Related

* [How does SimpleSpa transmit data securely?](/simplespa-documentation/extras/faq/how-does-simplespa-transmit-data-securely.md)
* [How is the data on the SimpleSpa network protected?](/simplespa-documentation/extras/faq/how-is-the-data-on-the-simplespa-network-protected.md)
* [Can you provide me with more information about your data centers?](/simplespa-documentation/extras/faq/can-you-provide-me-with-more-information-about-your-data-centers.md)