HIPAA Compliance

Understand how Amplify supports HIPAA-compliant communication and what your organization is responsible for.

Amplify supports HIPAA-aligned workflows on all plans

This article is for general informational purposes only and does not constitute legal advice.
Always review your Business Associate Agreement (BAA) and consult your compliance or legal team to ensure your organization meets all HIPAA requirements.

Organizations that handle patient information need communication tools that prioritize privacy, security, and accountability. Amplify is designed to support HIPAA-aligned workflows by providing secure document delivery, access controls, and audit visibility across fax and secure communication channels.

However, HIPAA compliance is a shared responsibility. While Amplify provides technical and administrative safeguards, your organization is responsible for how the platform is configured and used.

---

Business Associate Agreement (BAA)

To use Amplify in a HIPAA-compliant manner, your organization must have a Business Associate Agreement (BAA) in place.

A signed BAA outlines Amplify’s responsibilities as a service provider and clarifies how protected health information (PHI) is handled, safeguarded, and reported.

HIPAA-aligned features are only intended for use once a BAA is executed and your internal policies support compliant usage.

---

Using Amplify in a HIPAA-compliant way

Once a BAA is active, Amplify can be used to support HIPAA’s Privacy Rule and Security Rule, provided your organization applies appropriate operational controls.

Amplify helps by offering:

• Secure fax delivery
• Encrypted document access for recipients
• Role-based user permissions
• Audit logs and activity tracking
• Secure portals for document viewing

Your organization remains responsible for user training, access management, and determining what information is shared through each channel.

---

What counts as PHI?

Understanding what qualifies as Protected Health Information (PHI) helps determine how and where information should be shared.

Always PHI	Sometimes PHI	Not PHI
Patient name with identifiers	Appointment reminders tied to a patient	Office hours
Medical records or test results	Follow-up requests	General announcements
Diagnoses or treatment details	Care coordination messages	Educational content
Insurance or billing details	Contextual identifiers	Public contact information

If information can identify a patient in context, treat it as PHI.

---

Communication channels and compliance considerations

Amplify offers multiple delivery channels. Each has different compliance considerations depending on the type of information shared.

Fax and Secure Fax

• Designed for healthcare document exchange
• Supports secure transmission and audit visibility
• Suitable for PHI when used according to internal policies

Secure Email and Secure Links

• Documents are shared via encrypted access links
• Recipients do not need an account
• Access controls such as expiration and authentication can be applied

Secure SMS

• Intended for notifications or limited document sharing
• Requires patient consent
• PHI should be minimized

Your organization is responsible for determining what information is appropriate for each channel.

---

AI-powered features and HIPAA considerations

Amplify includes AI-assisted features such as AI Chat, document summaries, and template generation to help teams work more efficiently.

AI features can be used in HIPAA-aligned workflows when:

1. Patient awareness
   Patients are informed when AI-assisted tools are used in document processing or communication.
2. Minimum necessary use
   Only the required information is processed to complete a task.
3. Access controls
   AI-generated outputs are only accessible to authorized users.
4. Internal documentation
   Your organization documents the decision to use AI features and associated safeguards.

AI tools analyze document content but do not modify original records unless explicitly saved by a user.

Always consult your compliance or legal team before enabling AI features for workflows involving PHI.

---

Audit logs, visibility, and accountability

Amplify provides audit-friendly visibility to help organizations meet HIPAA accountability requirements, including:

• Delivery status tracking
• User activity logs
• Timestamps for sent and received documents
• Centralized access to fax and document history

These tools support internal audits, incident reviews, and compliance reporting.

---

Third-party integrations

Any third-party systems connected to Amplify—such as external storage, analytics tools, or downstream systems—are not automatically covered under your Amplify BAA.

Your organization is responsible for ensuring:

• Appropriate agreements are in place
• Data shared with third parties is compliant
• Risks are documented internally

---

Session management and access security

To help reduce unauthorized access, Amplify enforces session controls and supports secure access practices.

Organizations may also apply:

• Device-level auto-lock policies
• Strong password requirements
• Internal access reviews

Combine Amplify’s built-in safeguards with your organization’s device and identity policies for stronger compliance.

---

FAQs

Is Amplify HIPAA compliant by default?

Amplify provides HIPAA-aligned features, but compliance depends on having a signed BAA and using the platform according to your internal policies.

Can we use AI features with PHI?

Yes, if used responsibly. Your organization must ensure patient awareness, limit data to the minimum necessary, and document safeguards internally.

Who is responsible for HIPAA compliance?

HIPAA compliance is shared. Amplify provides technical safeguards, while your organization controls configuration, access, and usage.