GetHIPAAcheck is an independent HIPAA compliance-support tool designed to help solo providers and small healthcare practices review key compliance areas, identify potential gaps, organize assessment responses, and review recommended next steps.
GetHIPAAcheck is not affiliated with or endorsed by the U.S. Department of Health and Human Services ("HHS") or the Office for Civil Rights ("OCR").
Depending on how you use GetHIPAAcheck, the service may process information such as:
userId and auditId.
GetHIPAAcheck assessments are intended to review organizational practices and safeguards. Patient-level information is generally not necessary to complete the assessment.
Do not enter PHI into GetHIPAAcheck assessment responses, feedback fields, or support messages.
Examples of information that should not be submitted include:
GetHIPAAcheck may use browser local storage to maintain technical identifiers, plan information, subscription references, assessment state, feature settings, and other information needed for the service to function.
Depending on the feature, locally stored values may include items such as:
userIdauditIdYou can normally remove locally stored information through your browser's site-data or storage settings. Removing local data may reset certain features or require subscription verification again.
GetHIPAAcheck may use analytics and internal event logging to understand how pages and product features are used, measure conversions, diagnose problems, and improve the service.
This may include Google Analytics 4 ("GA4") and GetHIPAAcheck's own server-side logging systems.
Depending on the page and configuration, analytics or operational events may include:
GetHIPAAcheck does not intend these analytics systems to receive patient PHI.
Paid GetHIPAAcheck features may use third-party payment providers such as PayPal.
GetHIPAAcheck may process payment or subscription reference IDs and subscription status information for the purpose of determining plan access.
Payment providers operate under their own privacy policies and terms. GetHIPAAcheck does not control how those providers independently process payment information.
Some plans or product features may provide assessment reports, report history, saved assessment information, or related documentation features.
When these features are used, relevant assessment or report information may be transmitted to and stored by GetHIPAAcheck systems as necessary to provide the feature.
Report availability and retention depend on the applicable plan and product feature.
If you voluntarily enable browser notifications, GetHIPAAcheck may store technical push-subscription information required to deliver those notifications.
You can disable browser notifications through your browser or device settings.
GetHIPAAcheck may rely on third-party service providers to operate certain features.
Depending on the feature used, these providers may include:
These third-party services may process information according to their own terms and privacy policies.
Information may be retained for as long as reasonably necessary to provide requested features, maintain subscription access, preserve reports or history where applicable, protect the service, troubleshoot technical problems, satisfy legal obligations, or maintain legitimate operational records.
Different categories of information may have different retention periods.
You may clear browser-stored information using your browser's site-data controls.
For questions about server-stored information or to request deletion of information that can reasonably be associated with your GetHIPAAcheck technical identifier or subscription reference, contact:
Some information may need to be retained when required for legal, security, fraud-prevention, accounting, or legitimate operational purposes.
GetHIPAAcheck uses reasonable technical and organizational measures intended to protect information processed by the service.
However, no website, database, transmission method, or storage system can be guaranteed to be completely secure.
GetHIPAAcheck is an independent compliance-support tool. It is not affiliated with, endorsed by, certified by, or approved by HHS or OCR.
Completing an assessment, receiving a report, or following a recommendation does not certify HIPAA compliance and does not constitute government approval.
Assessment results and reports are intended to support internal review and documentation.
GetHIPAAcheck does not provide legal advice and use of the service does not create an attorney-client, consultant-client, or other professional advisory relationship.
The service is provided on an "as is" and "as available" basis to the extent permitted by applicable law.
GetHIPAAcheck does not guarantee that every compliance requirement, risk, vulnerability, or legal obligation will be identified through use of the service.
Users remain responsible for evaluating their own legal and regulatory obligations and implementing appropriate safeguards.
If GetHIPAAcheck's TikTok publishing integration is enabled and you choose to use it, the service may access information and permissions necessary to connect the authorized TikTok account and perform user-requested publishing functions.
If this integration is not currently offered, this section may be removed from the policy.
GetHIPAAcheck may update these terms and privacy disclosures when product features, data practices, service providers, or legal requirements change.
The updated date shown at the top of this page indicates the most recent revision.
For privacy, legal, support, or data-removal questions: