How Bia protects client data

Bia is HIPAA compliant and follows industry best practices for security. Every provider account includes a Business Associate Agreement.

HIPAA and your BAA

You accept Bia's Business Associate Agreement when you create your account. It is included at no cost, whether you or your clients pay. Read the Business Associate Agreement.

Encryption and hosting

Every connection uses HTTPS, and browsers are told never to connect without it. Data is encrypted at rest and hosted on Amazon Web Services in the United States. Bia's BAA requires every subcontractor that handles client data, Amazon included, to agree to the same HIPAA terms.

Sign-in and sessions

Passwords are stored as salted hashes, common passwords are refused, and repeated failed sign-ins are slowed down. A session ends after 60 minutes without activity and 24 hours after sign-in, and provider accounts have no stay-signed-in option.

Access and activity

In an organization, what each member can see depends on their role. Sign-ins, password changes and exports are recorded in your security activity, kept for 6 years, and cannot be edited or deleted by anyone.

Your data

Export reports and records at any time. Bia never sells data or shares it with third parties.

Questions

If your practice needs more detail for a security review, schedule a demo or email support@biajourney.com.

Schedule a demo