# HIPAA compliant longevity clinic software, by design Source: https://www.longevityehr.com/security Every clinic accepts the same Business Associate Agreement, every clinic's records are walled off from every other clinic's, and extracted lab values reach a patient only after your team releases them. ## A HIPAA compliant EHR starts with a BAA Where it starts LongevityEHR is HIPAA compliant longevity clinic software. It handles patient health information for your clinic, so we act as your business associate. Every clinic accepts the same [Business Associate Agreement](https://app.longevityehr.com/legal/clinic/business_associate_agreement) when it signs up, on behalf of the clinic, and we sign a copy on request. The agreement is the paperwork. The rest of this page is how the product itself treats patient data, from who can open a chart and what reaches the [white-label patient portal](https://www.longevityehr.com/white-label-patient-portal) to what happens when someone clicks delete. ## HIPAA compliant longevity clinic software, control by control Eight safeguards built into the product, not added on top of it. Hover or tap a card to read how each one works. ### Tenant-isolated data Every record a clinic owns is tied to that clinic, and every query is limited to it by default. A request for another clinic's record answers as if it does not exist. ### Role-based permissions Staff are Owners or Providers, and patients see only their own record. Team, billing, branding and [biomarker ranges](https://www.longevityehr.com/biomarker-tracking) are managed by the Owner. ### Audit trail Every read of and change to patient data is recorded: who, which patient, when, and for a change the values before and after. Sign-ins are recorded too. ### Archived, never destroyed Delete in LongevityEHR means archive. The record stays with the clinic that owns it, because medical records have to be kept. ### Automatic sign-out Sessions end after a period without activity, 15 minutes by default, with a warning before it happens. ### Kept out of analytics Product analytics record only events the team chose to track, never page content by default. Application logs carry ids, not what a patient record says. ### Card numbers go to Stripe Patient card payments go straight to Stripe, never through LongevityEHR's servers. The name of a purchased service and any clinical detail stay out of Stripe. ### No AI training on patients Your patients' data is never used to train AI models. AI reads lab reports, and your team reviews every value before release. ## Your team decides what patients see Release rules A patient can see that a lab report was uploaded, and the report itself, from the start, because it is their data. Everything read from it waits for your team: a provider decides what is released and what stays in the chart. - Extracted values from [AI lab extraction](https://www.longevityehr.com/ai-lab-extraction), their ranges and the provider's interpretation reach the patient's portal only after a provider reviews and releases them. - A unit that doesn't match the biomarker blocks release until someone confirms it. Units are flagged, never converted. - Each [clinical note](https://www.longevityehr.com/clinical-notes) has its own setting for whether the patient can see it. - A patient reaches the portal only after accepting your clinic's invitation and setting their own credentials. AI in LongevityEHR reads lab reports so your team doesn't retype them, and the interpretation stays with your providers. Values are graded against the ranges your clinic set, and providers write every word of interpretation. ## The same safeguards, seen from every side Who it protects What the product does with patient data depends on who is asking. Pick a role to see how it applies. ### A signed agreement, your settings and records that stay yours ### AI does the reading, the provider makes the call ### Their own record, and only what their provider released ### We act as your business associate ## What LongevityEHR never does with patient data Clear limits - Use it to train AI models. - Let AI interpret a lab result or write a clinical conclusion. - Show extracted lab values or an interpretation to a patient before a provider releases them. - Destroy a patient's record when someone clicks delete. - Take card numbers through its own servers. Patient card payments go straight to Stripe. - Send the name of a purchased service or any clinical detail to Stripe. ## Frequently asked questions ### Is LongevityEHR HIPAA compliant? Yes. LongevityEHR is built to handle protected health information under HIPAA, and every clinic accepts a Business Associate Agreement at signup. ### Will LongevityEHR sign a BAA? Yes. Every clinic accepts the same [BAA](https://app.longevityehr.com/legal/clinic/business_associate_agreement) when it signs up, and we sign a copy on request. ### Is my clinic's data kept separate from other clinics? Yes. Every record is tied to the clinic that owns it, and every query is limited to that clinic by default, so one clinic can never read another's patients. ### Is patient data used to train AI models? No. Patient data is never used to train AI models. AI is used to read lab reports, and your team reviews every value before release. ### What happens when we delete a patient? The patient is archived, not destroyed. Their portal access ends and the record stays available to your clinic, because medical records have retention requirements. ### Who can change biomarker ranges or clinic settings? The clinic Owner. Team invitations, billing, branding and biomarker ranges are Owner permissions, and providers work in the charts.