HIPAA Compliance

1. At a glance

The HIPAA add-on is available for US-region accounts from September 2026. It requires a parent (agency) account in good standing, designating the specific accounts that will handle PHI, and a fully executed BAA. HIPAA mode is intentionally restrictive: features that would route data to a vendor without an executed BAA are not available for PHI.

2. Safeguards in scope

The following technical safeguards are part of the HIPAA-enabled platform. They apply to the covered platform itself — not to third-party tools or integrations that sit outside it (see Section 3).

• Tenant isolation: every account is provisioned with its own physically separate database rather than sharing tables with other customers, which eliminates cross-tenant data exposure.
• Encryption at rest: field-level AES-256-GCM application encryption with a unique Data Encryption Key (DEK) per account. Contact identifiers and communication-channel credentials are encrypted today, and coverage is being extended (see Section 7).
• Key hierarchy: the master Key Encryption Key lives in HashiCorp Vault Transit and is non-exportable; per-account DEKs are stored wrapped, never in plaintext. HIPAA account keys rotate annually and are crypto-shredded on deletion.
• Encryption in transit: TLS 1.2+ for all client and API traffic, and a WireGuard-encrypted private mesh between NextGen-operated servers for replication and internal traffic.
• Blind indexing: per-account HMAC-SHA256 indexes allow exact-match lookups on encrypted values (for example finding a contact by email) without ever decrypting the stored data or comparing plaintext across accounts.
• Access control: role- and permission-based access using bitmask permissions, account-scoped tokens, API key hashing, MFA enforcement, and object-level checks that prevent one account from reading another account's records.
• Audit logging: reads of PHI-bearing records (contacts, pipelines, ticketing, calendar bookings, form submissions, inbox and invoices) and all writes are recorded with the acting user, account, path, result, IP address and user agent.
• Backups: continuous replication to encrypted object storage in the United States, with a documented restore procedure and retention policy. Compliance documentation is retained for six years.
• Regional isolation: HIPAA accounts are US-region only. Data, processing and backups stay inside that region.

3. What the BAA covers — and what it does not

Like other CRM platforms, our BAA covers the core platform that NextGen operates. It does not, and cannot, extend to third-party services that our platform can connect to — we cannot commit a vendor to safeguards on their behalf.

Covered by our BAA

• CRM records: contacts, custom fields, notes and tasks
• Calendars, availability and bookings
• Forms and form submissions
• Pipelines and opportunities
• Internal workflow actions executed inside the platform
• Websites, funnels and pages
• Ticketing and support records
• Documents, contracts and e-signature records
• Invoices and estimates as records (payment processing itself is excluded)
• Client portal, memberships and communities
• Dashboards and analytics over in-platform data

Not covered by our BAA

Anywhere data leaves the covered platform — by email, SMS, voice, webhook, API call or a third-party integration — falls outside our BAA. This is the category where healthcare businesses most often create exposure, so treat it as your responsibility.

• Email and SMS/voice delivery, and any marketing sends
• Outbound webhooks and custom API calls to external systems
• Third-party integrations, including social and messaging channels
• Payment processors and accounting tools
• Media and files hosted on our CDN
• Any vendor listed as Excluded or Not executed in Section 4

4. Subprocessors and BAA status

Transparency about our own vendors is part of the compliance obligation we accept when we sign your BAA. The table below is the complete list of third parties that may be involved in operating a HIPAA account, with the current status of each. It is reviewed regularly and updated as agreements are executed.

On conduits. Under 45 C.F.R. §160.103, a vendor whose function is limited to transmitting PHI — and which does not access PHI other than on a temporary basis as necessary to carry out the transmission — is not a business associate. We obtain and retain written confirmation from each vendor we treat as a conduit, and we confirm that PHI is not persisted, logged in content form, recorded or transcribed by that vendor. Where a vendor stores or processes the content of a communication (for example message bodies, call recordings or transcripts), a BAA is required and PHI is not sent until one is executed.

On alignment with your own obligations. Your BAA with us requires you to ensure that any subcontractor you engage — including integrations you enable — agrees to equivalent restrictions. Vendors marked Not permitted above are excluded from our HIPAA scope on purpose; enabling them for PHI is not covered by our BAA or theirs.

5. How to request a BAA

BAAs are executed with the parent (agency) account that contracts with NextGen OS, Inc., and apply to the accounts you designate. Our standard form is available for review, so you can see the terms before you commit — but a BAA is only effective once it has been completed, countersigned by us and returned to you.

• Step 1 — Confirm scope. Identify your role (covered entity or business associate), the accounts and sub-accounts that will handle PHI, and the categories of PHI involved.
• Step 2 — Add the HIPAA add-on. Enable HIPAA compliance for the designated US-region accounts ($10/month per account, capped at $300/month total).
• Step 3 — Request the BAA. Email legal@mail.thenextgencrm.com with your legal entity name and address, the name and title of your authorised signatory, your account IDs, and a security contact for breach notification.
• Step 4 — Execute. We review, complete and countersign the BAA, then return the executed copy. We aim to respond to BAA requests within five business days.
• Step 5 — Activation. HIPAA mode is enabled on the designated accounts once the BAA is fully executed. Non-covered channels may be restricted so PHI cannot reach an excluded service.

Reviewing the standard form: view our Business Associate Agreement (password required — ask your account manager or email us for access). The copy you sign is completed and countersigned; the reviewable copy is a working draft that shows our standard terms.

A BAA is not required if you do not handle PHI. If you only store incidental contact details for non-healthcare purposes, your standard account and terms remain appropriate.

6. Your responsibilities

HIPAA compliance is shared. We secure the platform and commit to the obligations in the BAA; you remain responsible for how you use it.

• Determine your status. Decide whether you are a covered entity or a business associate, and what in your data constitutes PHI.
• Minimum necessary. Store only the PHI you actually need, and limit access to workforce members who need it.
• Keep PHI inside the covered scope. Do not place PHI in excluded features, integrations, media libraries or payment records (see Section 3).
• Manage your workforce. Maintain your own access-control policies, unique user accounts, MFA and HIPAA training.
• Configure your own integrations carefully. If you connect a third-party service for PHI, you must execute your own BAA with that provider first.
• Keep contacts current. Nominate a security contact so we can notify you of a security incident without unreasonable delay and no later than the timeframe required by 45 C.F.R. §164.410.
• Retention and disposal. Your data-retention policy remains yours; account deletion and key destruction provide cryptographic erasure on request.

7. Program status

We publish this section rather than implying a finished program. Items still open, as of the date at the top of this page:

• Executing BAAs with the remaining vendors that require one, and removing or disabling any path that would send PHI to a vendor without an executed BAA.
• Extending field-level encryption coverage beyond contact identifiers and channel credentials to notes, messages, tickets, form submissions and call logs.
• Client-side encryption of backup snapshots, so backups are unreadable without keys held in our secrets manager rather than relying on storage-level encryption alone.
• Full-disk encryption on dedicated US HIPAA infrastructure.
• Formal HIPAA Security Risk Analysis and written policies for access control, incident response, breach notification, retention and disposal, workforce training and sanctions.
• Formal designation of a Security Officer and a Privacy Officer.

None of the above limits the commitments we make in an executed BAA. Where a safeguard is not yet in place, PHI is not processed through that path.

8. Contact

Questions about HIPAA coverage, BAA execution or this page: