HIPAA Compliance

Carelynk is designed from the ground up with HIPAA compliance in mind. We understand that RCFE operators handle sensitive resident health information and take our responsibilities as a technology partner seriously.

Carelynk enters into a Business Associate Agreement (BAA) with all covered entity customers. Contact us at hello@carelynk.io to execute a BAA before going live.

• End-to-end HTTPS encryption for all data in transit
• AES-256 encryption for data at rest
• Role-based access controls — staff only see what they need for their role
• Automatic session timeouts
• Audit logs of all data access and changes
• No PHI included in email notifications (login to view)

• Staff access provisioned by facility administrator
• Regular access reviews recommended
• Incident response procedures in place
• Employee training on HIPAA obligations

• Data hosted on SOC 2 compliant infrastructure (Supabase)
• No physical access to servers by Carelynk staff

• We do not sell or share PHI with third parties
• We do not include PHI in email notifications
• We do not use resident data for advertising
• We do not access your facility data without authorization

If you believe there has been a breach or HIPAA violation, contact us immediately at hello@carelynk.io or call (800) XXX-XXXX.