HIPAA

RHAWK can be configured for use by HIPAA Covered Entities and their Business Associates (dental practices, medical clinics, home-health, wellness providers). This page summarizes what we do and where the boundaries are. HIPAA support is available on our Healthcare and Dental plans.

PHI can enter the platform when you upload patient contact lists, connect a healthcare EHR/PMS via webhook, or exchange messages with patients. Public reviews on Google, Healthgrades, Zocdoc etc. are already public content and generally not PHI.

• Encryption in transit (TLS 1.2+) and at rest (AES-256).
• Row-level security so a customer's data is never returned in another customer's query.
• Audit logs of access to patient-contact records.
• Least-privilege access for the small on-call engineering team, MFA required.
• Documented incident-response plan.

For customers on the Healthcare or Dental plans, we execute a Business Associate Agreement (BAA) before any PHI is uploaded or synced. Email compliance@ratehawk.app to request our BAA template.

• Do not upload PHI to RHAWK until a signed BAA is in place.
• AI reply generation for patient-review responses should never restate PHI. Our templates are designed to keep replies generic and compliant.
• You remain responsible for your own HIPAA compliance program, staff training and patient authorizations.