HIPAA & Security Notice
Last updated July 22, 2026
Our Role
MedAestheticsOS is a Business Associate under HIPAA when a signed Business Associate Agreement (BAA) is in place with a Clinic. The Clinic is the Covered Entity and remains responsible for the uses and disclosures of PHI it authorizes.
Business Associate Agreement
A BAA is required before entering identifiable PHI. Request one at support@medaestheticsos.io. The BAA includes required §164.504(e) provisions: permitted uses, safeguards, sub-BAAs with our sub-processors, breach reporting, audit access, and return/destruction on termination.
Administrative Safeguards (§164.308)
Named Security Officer, workforce training, role-based access, sanction policy, periodic risk analyses, and documented incident response procedures.
Physical Safeguards (§164.310)
PHI is hosted in SOC 2 Type II certified US data centers with 24/7 monitoring, biometric access controls, and disaster recovery.
Technical Safeguards (§164.312)
Unique user IDs, automatic session timeout, TLS 1.2+ encryption in transit, AES-256 at rest, integrity controls via SHA-256 content hashing on signed documents, and immutable audit logs of every PHI create/read/update/delete event with actor, timestamp, IP, and user agent.
Audit Logging
Every action against PHI is recorded to an append-only log retained for a minimum of 6 years, viewable by Clinic owners and administrators from the Back Office.
Breach Response
In the event of a suspected breach of unsecured PHI, we will notify affected Clinics without unreasonable delay and in no case later than 60 days from discovery, consistent with §164.410.
Patient Rights
Patients should exercise HIPAA rights (access, amendment, accounting of disclosures, restrictions) directly with their Clinic. The Clinic's Notice of Privacy Practices controls these interactions.
Contact
All security, privacy, and compliance inquiries: support@medaestheticsos.io
This document is provided for informational purposes and is not legal advice. Clinics should have counsel review before onboarding.