HIPAA alignment is a system of safeguards—not one checkbox.

What HIPAA-aligned means here

“HIPAA-aligned” describes the direction and controls used in development. It should not be read as a blanket certification of every environment, person, workflow, vendor, or future feature. HIPAA compliance depends on how the complete system is designed, configured, operated, documented, and monitored.

The OpenAI Business Associate Agreement

PBRx uses eligible OpenAI API services under an executed Business Associate Agreement (BAA), with approved data-retention controls, to support HIPAA-compliant processing of protected health information.

A BAA defines responsibilities for permitted handling of protected health information between covered entities or business associates and a service provider. It is an important contractual safeguard, but it does not make an entire product compliant by itself.

The Proton Business Associate Agreement

PBRx uses Proton Mail for business email and has entered into an executed Business Associate Agreement with Proton. Proton provides encrypted email services designed to support appropriately configured handling of protected health information.

Messages within Proton are encrypted automatically. Messages sent to or received from outside email providers are not automatically end-to-end encrypted unless additional protection, such as Proton password-protected email, is used. The Proton BAA applies to covered Proton services; it does not cover the public PBRx.Vet website, Netlify forms, unrelated systems, or make every email workflow automatically HIPAA compliant. The public website and ordinary email are not medical-record submission channels.

For more information, see Proton’s healthcare and HIPAA information and the HHS guidance on business associates.

Controls beyond the BAA

• Use only eligible services and approved configurations for protected health information
• Apply access, authentication, encryption, logging, and retention controls
• Limit information to authorized purposes and users
• Maintain policies, training, risk analysis, incident response, and vendor oversight
• Separate public informational systems from authenticated health-data systems
• Validate each production workflow before protected information is accepted

Current status

PBRx remains a controlled functional prototype in closed beta. Production claims and notices will be updated as validation, deployment scope, and operating responsibilities are finalized.