HIPAA and health data hosting, explained
What HIPAA requires of a service handling United States health data, what a business associate agreement is for, and what Voroa offers for this today.
What this covers
HIPAA is a United States law governing protected health information: patient records, treatment details, anything identifying a person alongside their health data. If you build software handling that data, the obligations reach your infrastructure provider too, because they are storing and transmitting it on your behalf. That relationship has to be formalised in a business associate agreement, a signed contract in which the provider accepts specific responsibilities for how the data is protected. Without one, the provider cannot lawfully be used for that data at all.
Voroa does not offer a business associate agreement and does not support hosting protected health information. Nothing on this page should be read as a claim of HIPAA compliance or as a statement that Voroa is working towards it. Do not put protected health information on Voroa.