HIPAA Compliance

At TheraPro LLC, we recognize that our clients entrust us with the most sensitive and regulated type of data: patient health information. Safeguarding Protected Health Information (PHI) is more than a legal requirement — it is an ethical responsibility that defines who we are as a company.

TheraPro was built from the ground up to be HIPAA-compliant, fully managed, and white-labeled for therapy clinics. This means clinics can confidently deploy a modern digital platform without hiring IT teams or worrying about hidden compliance gaps.

This statement provides a comprehensive overview of our HIPAA compliance program, including policies, safeguards, risk management, and accountability structures. It is intended for clinics, compliance officers, regulators, and auditors who require a clear explanation of how TheraPro protects PHI across all layers of our platform.

1. HIPAA Compliance Framework

TheraPro adheres to the three core HIPAA regulatory rules, along with HITECH amendments:

• Privacy Rule – Controls the use and disclosure of PHI and ensures patients’ rights to access and control their information.
• Security Rule – Requires administrative, physical, and technical safeguards for electronic PHI (ePHI).
• Breach Notification Rule – Requires covered entities and business associates to provide notifications in case of a breach of unsecured PHI.
• HITECH Act Amendments – Expand enforcement, increase penalties, and ensure that electronic PHI receives the same protection as traditional PHI.

TheraPro’s compliance framework is structured around:

• Administrative Safeguards – Policies, procedures, training, and role-based oversight.
• Technical Safeguards – Encryption, access control, monitoring, and logging.
• Physical Safeguards – Secure data center infrastructure through HIPAA-eligible cloud vendors.

2. Business Associate Agreements (BAAs)

BAAs form the legal foundation of HIPAA compliance. TheraPro LLC executes BAAs in two contexts:

• Amazon Chime SDK (AWS) – Telehealth video sessions, covered by TheraPro’s AWS BAA. Video is not recorded; visit audio is captured only to create the transcript and Smart Note draft, then deleted.
• Secure in-app messaging – Encrypted messages stored in TheraPro’s AWS environment.
• Amazon SNS – Push notifications to the clinic’s patient app.
• Amazon SES – Email for invitations, reminders and account notices.
• Wasabi – HIPAA-ready storage for files, forms, and recordings.
• AWS (Lambda, DynamoDB, API Gateway, CloudWatch, IAM) – HIPAA-eligible infrastructure services under the AWS BAA.

This chain of trust ensures that PHI is never processed or stored by a service provider not bound to HIPAA’s legal standards.

3. Administrative Safeguards

Administrative safeguards ensure that HIPAA compliance is embedded in daily operations.

• A HIPAA Compliance Officer oversees policy enforcement, risk assessments, and incident response.
• The officer reports directly to executive leadership.

Policies & Procedures:

• Formal HIPAA policies cover PHI handling, access, disposal, breach notification, and vendor management.
• Policies are reviewed and updated at least annually, or when regulations change.

Employee Training:

• Mandatory HIPAA training for all staff upon hire, with annual refreshers.
• Specialized training for engineers, support staff, and leadership.
• Training modules cover data minimization, PHI redaction, and secure communication.

Risk Assessments:

• Annual third-party HIPAA risk assessments.
• Internal quarterly reviews to identify new risks.
• Documented risk mitigation strategies and remediation plans.

Vendor Due Diligence:

• Vendors undergo compliance review prior to onboarding.
• Security questionnaires, SOC 2 / ISO reports, and HIPAA attestations are required.
• BAAs must be signed before PHI flows through any vendor service.

Access Management:

• Staff access follows the principle of least privilege.
• Access is reviewed quarterly.
• Accounts are revoked immediately upon role change or departure.

Contingency Planning:

• Business continuity and disaster recovery plans ensure service availability.
• Regular tabletop exercises test emergency response procedures.

4. Technical Safeguards

TheraPro employs multiple layers of technical controls:

• Data in transit: TLS 1.2+ with Perfect Forward Secrecy.
• Data at rest: AES-256 for DynamoDB, Wasabi, and backups.

Role-Based Access Control (RBAC):

• Patient, Therapist, Clinic Admin, and TheraPro Engineering roles.
• Fine-grained IAM policies restrict database access per clinic.

Audit Controls:

• Immutable logs capture every PHI-related action.
• Logs are reviewed for anomalies, retained, and auditable.

Application Security:

• Secure coding practices, peer reviews, and automated scans.
• Third-party penetration tests twice per year.
• OWASP Top 10 security risks continuously monitored.

Database & Storage Isolation:

• Each clinic has its own DynamoDB namespace and Wasabi storage bucket.
• Test and development environments contain no PHI.

Monitoring & Alerts:

• Real-time anomaly detection.
• CloudWatch alerts on suspicious behavior.
• Sentry monitors application errors across environments.

Backup & Recovery:

• DynamoDB Point-in-Time Recovery (PITR).
• Daily Wasabi snapshots.
• Quarterly disaster recovery testing.

5. Physical Safeguards

TheraPro relies on HIPAA-compliant cloud infrastructure. AWS and Wasabi data centers enforce:

• 24/7 video surveillance.
• Multi-factor access controls (biometric + keycard).
• Environmental controls (redundant power, HVAC, fire suppression).
• Secure hardware decommissioning and data destruction protocols.

By leveraging cloud-native infrastructure, TheraPro ensures clinics benefit from enterprise-grade physical security without maintaining servers.

6. Breach Notification Protocol

In compliance with the HIPAA Breach Notification Rule, TheraPro maintains a formal incident response program.

• Clinics notified without unreasonable delay, no later than 60 days.
• Reports include nature of the breach, data affected, and recommended actions.
• HHS notified per regulatory timelines.

Remediation: Post-incident analysis, root cause identification, and system updates.

Documentation: Every incident logged for compliance reporting and future audits.

7. Data Lifecycle Management

• Retention: PHI retained only as long as required for treatment, operations, or legal purposes.
• Export: Clinics can request PHI exports in structured formats.
• Deletion: Secure deletion processes using NIST SP 800-88 standards.
• De-identification: Where possible, PHI is anonymized for analytics.

8. Shared Responsibility Model

HIPAA compliance is shared between TheraPro and the clinic:

• Infrastructure security.
• Vendor management and BAAs.
• Encryption, logging, monitoring.
• Breach notification.

Clinic’s responsibilities:

• Obtaining patient consent.
• Training staff on HIPAA policies.
• Limiting PHI exposure in daily workflows.
• Ensuring secure endpoint/workstation practices.

TheraPro supports clinics with compliance documentation, admin panel tools, and staff training resources.

9. Continuous Compliance

HIPAA compliance is ongoing, not static. TheraPro ensures continuous improvement through:

• Annual independent HIPAA audits.
• Quarterly penetration testing.
• Regular policy reviews.
• Active monitoring with real-time alerts.
• Dedicated compliance team.

10. International Transfers

TheraPro primarily operates in the United States. If PHI must be processed internationally, it is done only with HIPAA-bound vendors, secure encryption, and contractual safeguards.

11. Future Roadmap

TheraPro will continue investing in compliance by:

• Expanding audit and compliance certifications (SOC 2, HITRUST).
• Enhancing patient-facing privacy controls.
• Integrating AI-driven anomaly detection for PHI access patterns.
• Expanding reporting tools for clinics to simplify HIPAA audits.

12. Contact Information

For compliance inquiries, documentation requests, or security concerns, contact:

TheraPro LLC – Compliance Office

Email: compliance@therapro.app

Website: www.therapro.app