How we protect the health information you trust us with

NoteIQ is classified as a Business Associate under HIPAA, and our security program is built to meet the Privacy, Security, and Breach Notification Rules of the Health Insurance Portability and Accountability Act of 1996.

Business Associate under HIPAA
Policies and procedures reviewed annually
Last reviewed: August 19, 2026

‍

What We Do To Keep It That Way

Our program combines how we train and manage our people with how we build and run our systems. Every safeguard below is reviewed at least once a year, and policy copies are available to customers on request.

‍

Administrative Safeguards (People & process)

• HIPAA training for every employee. Completed upon hire and refreshed every year, so the rules stay current for everyone handling PHI.
• Signed confidentiality agreements. Every employee agrees to protect confidential information as a condition of employment.
• Annual policy review. Policies and procedures are reviewed at least once a year against new or revised regulations. Copies are available on request.
• Business Associate Agreements. Every subcontractor that processes PHI on our behalf signs a BAA committing to the same HIPAA standards we hold ourselves to.
• Breach logging & response. Any suspected breach is logged, investigated, and reported through a defined incident response process.

‍

Technical Safeguards (Systems & data)

• Automatic password expiration. Credentials rotate on a set schedule so access can't rely on a stale password.
• Account lockout on failed logins. Repeated failed sign-in attempts lock the account, blocking brute-force access.
• Least-privilege access. Access to restricted information is granted strictly on a need-to-know basis.
• Encryption at rest and in transit. PHI is encrypted both while stored and while moving between systems.
• Automatic virus scanning. Systems are scanned continuously to catch malicious software before it spreads.
• Secure, redundant backups. Data is backed up on a regular schedule so it can be recovered without loss.
  
  ‍

Compliance program last reviewed August 19, 2026