HIPAA readiness Disclosure

Last Updated: September 1, 2026

1. Introduction & Scope

NudgeWell is preparing an evidence-backed HIPAA-readiness baseline for customers whose approved, consented use case may involve sensitive health data. This page describes controls implemented in this repository and the legal, vendor, security, and operational prerequisites that still require owner evidence.

Who this applies to: This disclosure is relevant to healthcare organizations, health plans, healthcare clearinghouses, healthcare providers, and any employer who offers group health coverage subject to HIPAA and who uses NudgeWell's enterprise tier services.

Standard SMB tier: At the SMB tier (50–500 employees), NudgeWell does not collect, process, or store PHI. Our standard offering operates with benefits plan data only — wearable-derived categories are sensitive health data and are handled only through the documented opt-in controls. Enterprise customers requiring PHI handling can request a Business Associate Agreement (BAA) as described below.

2. What is PHI and EPHI?

PHI (Protected Health Information) includes any individually identifiable health information held or transmitted by a covered entity or its business associate, in any form (electronic, paper, oral).

PHI includes, but is not limited to:

• Patient names, addresses, phone numbers, email addresses
• Social Security numbers, medical record numbers, health plan beneficiary numbers
• Biometric identifiers, including photos or images
• Diagnosis codes, procedure codes, treatment information
• Any health information that could identify an individual in connection with healthcare services

EPHI (Electronic Protected Health Information) is PHI that is transmitted by or maintained in electronic media. NudgeWell's systems that handle EPHI (for customers with a signed BAA) are subject to the HIPAA Security Rule's requirements for administrative, physical, and technical safeguards.

3. How We Handle PHI

For enterprise customers who execute a Business Associate Agreement, NudgeWell may receive, process, and transmit the following categories of PHI in connection with benefits engagement services:

PHI Category	How We Use It
Health plan enrollment and eligibility data	To personalize benefits nudges, remind employees of available coverage, and track engagement with benefits programs
Claims data (anonymized or de-identified)	To identify gaps in preventive care, generate ROI analytics, and recommend appropriate benefits utilization
Provider information (NPI numbers, specialties)	To match employees with appropriate in-network providers and support the Benefits Coach provider finder
Utilization data (FSA/HSA balances, visit frequency)	To generate personalized nudges encouraging appropriate benefits usage and financial wellness

We do not store: Full medical records, diagnosis histories, prescription data, or detailed treatment plans. PHI or sensitive wellness data is used only for the approved purpose and retention policy. The approved categories, retention period, deletion exceptions, and individual-rights workflow require legal/privacy confirmation for each customer and are not established by this page.

4. Business Associate Agreement (BAA) Overview

Under HIPAA, a Business Associate Agreement (BAA) is required when a covered entity discloses PHI to a third-party vendor who performs functions or activities on behalf of the covered entity that involve the use or disclosure of PHI.

NudgeWell offers BAAs to enterprise customers who require PHI handling as part of their benefits engagement program. Our BAA includes:

• Defined scope: The BAA specifies exactly what PHI NudgeWell receives, how it is used, and the duration of the relationship
• Permitted uses: NudgeWell uses PHI only for the specific purposes defined in the agreement — delivering benefits engagement services to your workforce
• Subcontractor requirements: Any NudgeWell subcontractor with access to PHI is bound by equivalent protections in a written subcontract
• Minimum necessary standard: We access only the minimum PHI necessary to perform our services
• Termination obligations: Upon contract termination, return or destruction follows the executed agreement and owner/legal-approved process; no fixed period is asserted here

5. Security Safeguards

NudgeWell implements administrative, physical, and technical safeguards appropriate to the sensitivity of EPHI in our systems.

Administrative Safeguards

• Designated privacy and security officers: Named individuals responsible for HIPAA readiness program oversight
• Workforce training: All employees with access to EPHI complete HIPAA awareness training upon hire and annually
• Risk assessments: We conduct periodic risk assessments of EPHI handling processes and systems
• Access management: Role-based access controls limit EPHI access to personnel with a documented need
• Incident response: Documented procedures for identifying, responding to, and mitigating HIPAA security incidents

Physical Safeguards

• Data center security: EPHI storage uses encrypted database storage with AES-256-GCM at rest; access logs to hr_activity_logs
• Workstation controls: Company-issued devices running encrypted storage and MDM (Mobile Device Management) software
• Facility access: Physical access to systems hosting EPHI is restricted to authorized personnel via badge access and visitor logging

Technical Safeguards

• Encryption in transit: All EPHI transmitted to or from NudgeWell systems is encrypted using TLS 1.2 or higher
• Encryption at rest: EPHI stored in our database is encrypted using AES-256-GCM
• Access logging: All access to EPHI systems is logged with user identity, timestamp, and action performed
• Audit trails: We maintain metadata-only access trails; the retention period and accounting workflow require legal/privacy approval
• Automatic logoff: Systems housing EPHI implement automatic session timeout after period of inactivity
• Unique user IDs: Each employee with EPHI access has a unique user identifier; shared accounts are prohibited

6. Breach Notification

NudgeWell maintains a breach-assessment and notification coordination runbook template. Legal and privacy owners must confirm the applicable rule, timelines, and customer-specific process before use.

Our timeline:

• Discovery to notification: We will notify the affected covered entity within 72 hours of discovering a breach of unsecured PHI
• Investigation: We conduct a risk assessment to determine whether the breach requires individual notification (threshold: reasonable probability that PHI was compromised)
• Individual notification: If required, we work with the covered entity to notify affected individuals within 60 days of breach discovery
• Media notification: For breaches affecting 500 or more individuals in a state or jurisdiction, we assist the covered entity with notifying prominent media outlets within 60 days
• HHS notification: Breaches affecting 500 or more individuals are reported to the Department of Health and Human Services (HHS) Secretary within 60 days

Breaches affecting fewer than 500 individuals are reported to HHS annually within 60 days of the end of the calendar year in which the breach occurred.

7. Individual Rights

NudgeWell will coordinate individual-rights requests with the covered entity and privacy officer under the executed agreement and applicable law. The workflow, response timelines, and exceptions require owner/legal approval.

Requests should be directed to the covered entity or designated privacy contact. NudgeWell's repository contains deletion and access-review controls, but does not by itself establish a legal conclusion or complete an individual-rights request:

• Right of access: Individuals have the right to access their PHI. We redirect requests to the covered entity's designated privacy officer.
• Right to amend: If an individual believes their PHI is inaccurate, we assist the covered entity in processing amendment requests.
• Right to an accounting of disclosures: We maintain disclosure logs sufficient to provide an accounting of PHI disclosures for at least 6 years.
• Right to restrict: We honor any restrictions on PHI use or disclosure agreed upon between the individual and the covered entity.
• Right to confidentiality: Individuals have the right to request that PHI be sent to a different address or via alternative communication channels; we support these requests as directed by the covered entity.

8. Business Associate Obligations

As a business associate, NudgeWell agrees to the following obligations under HIPAA:

• Not use or disclose PHI except as permitted by the BAA and the Privacy Rule
• Safeguard PHI from inappropriate use or disclosure
• Report breaches of unsecured PHI to the covered entity
• Ensure subcontractors agree to the same restrictions and conditions
• Make PHI available for access and amendment
• Account for disclosures upon request
• Make internal practices, books, and records available to HHS for compliance audits
• Return or destroy PHI at the end of the service relationship

Our BAA incorporates these obligations by reference and includes the minimum necessary standard, workforce sanctions, and amendment provisions required by 45 CFR Parts 160 and 164.

9. Enforcement & Penalties

HIPAA is enforced by the Department of Health and Human Services (HHS) Office for Civil Rights (OCR). Civil penalties for HIPAA violations range from $100 to $50,000 per violation, with a maximum of $1.5 million per violation category per year. Criminal penalties (for knowing or willful violations) can result in fines up to $250,000 per violation and imprisonment up to 10 years.

NudgeWell takes compliance seriously. This repository contains a readiness control baseline and operational runbook templates. Named owners must complete access reviews, risk reviews, incident exercises, backup/restore validation, workforce training, and vendor reviews before relying on those controls as operational evidence. NudgeWell has not completed an independent HIPAA readiness audit and does not display third-party compliance certifications.

10. Contact Information & BAA Requests

For questions about this disclosure, to request a Business Associate Agreement, or to report a potential HIPAA concern:

NudgeWell Compliance Team
Email: hipaa@nudgewell.com
Enterprise inquiries: enterprise@nudgewell.com

If you believe your organization has experienced a HIPAA breach involving NudgeWell systems, please notify us immediately at hipaa@nudgewell.com so we can assist with your breach response process.

See also: Privacy Policy · Terms of Service