IBTx.ai HIPAA Compliance Package
Subscription, Security and BAA Management
Effective Date
01 July 2026
Last Updated
01 July 2026
1. Overview
IBTx.ai offers an optional, account-wide HIPAA Compliance Add-on that provides encryption for electronic Protected Health Information (ePHI), Business Associate Agreements (BAAs), audit logging, and mandatory Multi-Factor Authentication (MFA).
The package is available for $500 per month. Once purchased, it cannot be disabled or removed from the account.
$500
Per month, displayed and confirmed before payment
Customer Account
Protection applies across your entire Customer Account
Permanent
Cannot be deactivated once enabled
This document explains what the HIPAA Compliance package includes, how HIPAA responsibilities are shared between IBTx.ai and your organization, and how IBTx.ai protects ePHI on the platform.
Important
HIPAA compliance is a paid upgrade and is not enabled by default on IBTx.ai accounts. After purchasing and activating the package, HIPAA protection applies across your entire Customer Account on the platform. Once enabled, the package cannot be deactivated.
2. What Is HIPAA Compliance?
HIPAA stands for the Health Insurance Portability and Accountability Act of 1996, a United States federal law that establishes privacy and security requirements for protecting sensitive medical and healthcare information.
The legislation was signed into law by President Bill Clinton on August 21, 1996. It consists of five sections, commonly referred to as Titles:
| Title | Subject |
|---|---|
| Title I | HIPAA Health Insurance Reform |
| Title II | HIPAA Administrative Simplification |
| Title III | HIPAA Tax-Related Health Provisions |
| Title IV | Application and Enforcement of Group Health Plan Requirements |
| Title V | Revenue Offsets |
In the context of customer experience and digital business platforms, HIPAA Title II is generally the section people are referring to when discussing HIPAA compliance.
What Is HIPAA Title II?
Title II, also known as the Administrative Simplification provisions, establishes several requirements that organizations must follow when handling protected healthcare information.
These requirements include:
- National Provider Identifier Standard: Covered healthcare providers, including individual practitioners and healthcare organizations, must use a unique 10-digit National Provider Identifier (NPI) in standard transactions.
- Transactions and Code Set Standard: Healthcare organizations must follow standardized procedures for electronic data interchange (EDI) when submitting and processing insurance claims.
- HIPAA Privacy Rule: Formally known as the Standards for Privacy of Individually Identifiable Health Information, this rule establishes national requirements for protecting patients' health information and privacy.
- HIPAA Security Rule: The Security Standards for the Protection of Electronic Protected Health Information establish safeguards and requirements for securing electronic patient information.
- HIPAA Enforcement Rule: This rule defines the procedures and requirements for investigating and addressing HIPAA compliance violations.
The two requirements most relevant to the relationship between IBTx.ai and the Customer (the healthcare Practice using the platform) are the HIPAA Privacy Rule and the HIPAA Security Rule.
You can find additional information about these requirements through the following resources:
3. Key Benefits of the HIPAA Compliance Package
The IBTx.ai HIPAA Compliance package provides the following features and benefits:
|
Account-Wide Activation
Once enabled, HIPAA safeguards are applied across your entire Customer Account on the platform. |
Business Associate Agreement Included
A Business Associate Agreement (BAA) is provided as part of the package. |
|
Explicit Consent During Checkout
Required confirmations are presented during the purchase process to ensure that customers understand and intentionally authorize the activation. |
Clear and Transparent Pricing
The monthly subscription price of $500 is displayed and confirmed before payment is completed. |
|
Flexible Payment Method Selection
Customers can add a new payment method or select an existing one directly within the purchase window. |
Permanent Activation
After activation, HIPAA protection cannot be deactivated, removed, or downgraded on the account. Payments for the package are non-refundable. |
|
Editable BAA Signer Information
Signer details can be updated directly through IBTx.ai Documents & Contracts without needing to contact customer support. |
Automatic HIPAA Activation
HIPAA compliance features are automatically enabled once the BAA has been signed. No additional manual activation is necessary. |
4. IBTx.ai HIPAA Compliance
Within the direct relationship between IBTx.ai and the Customer (the healthcare Practice), the Customer is considered the HIPAA Covered Entity, while IBTx.ai is considered the HIPAA Business Associate.
| Party | HIPAA role |
|---|---|
| The Customer (the healthcare Practice) | HIPAA Covered Entity |
| IBTx.ai | HIPAA Business Associate |
IBTx.ai has worked with Compliancy Group to help ensure compliance with the HIPAA Privacy Rule and HIPAA Security Rule. This enables IBTx.ai to enter into HIPAA Business Associate Agreements (BAAs) directly with its Customers.
However, protecting the protected health information (PHI) of your patients also requires your organization, as the Covered Entity, to meet the applicable HIPAA Title II requirements.
If you need assistance identifying the requirements for bringing your organization into HIPAA compliance, please contact us to request the contact information for Compliancy Group, which can help guide your organization through the compliance process.
5. Security
Our database automatically encrypts information before it is written to disk. This process operates automatically, meaning customers do not need to complete additional setup or change their existing methods of accessing the platform.
When an authorized user requests information, the system automatically decrypts the data so it can be accessed as required.
Server-Side Encryption and Key Management
With server-side encryption, our cloud hosting providers (Google Cloud Platform and Amazon Web Services) manage the cryptographic keys on behalf of the platform using hardened key management systems designed to protect encrypted information.
These systems incorporate strict access controls and auditing procedures to help safeguard encryption keys.
The data and metadata associated with each database object are encrypted using the 256-bit Advanced Encryption Standard (AES-256).
Each individual encryption key is also protected through encryption using a set of master keys that are rotated regularly.
