Is Avochato HIPAA Compliant?

The short answer is, YES! Read on to learn about all of the specifics.

If you are reading this, you likely are familiar with HIPAA. HIPAA stands for Health Insurance Portability and Accountability Act, and is a federal law that sets national standards to protect sensitive patient health information from being disclosed without the patient’s consent or knowledge.

SMS is not inherently secure as a channel, because messages can be unencrypted and exchanged on personal devices.

However, there are ways to use SMS in a HIPAA-compliant manner. To do so, healthcare providers need to a) make sure patients give consent to use SMS as a communication channel and b) use a business solution that has the right security guardrails in place to protect PHI (Personal Health Information).

Avochato stores all PHI in a secure HIPAA-compliant cloud environment and we follow standard encryption protocol to protect your data every step of the way.

The cost for HIPAA Compliant messaging depends on many factors. Please reach out to your Avochato representative or contact sales at 415-214-8977 to discuss further.

Yes! MMS or multimedia messaging is HIPAA eligible. Outbound MMS sent by customers who sign a BAA with Avochato for HIPAA compliant use cases will be covered.

Yes, you can use our website widget to have SMS or Live Chat conversations with your patients.

No, WhatsApp, a subsidiary of Facebook, does not sign BAAs and the Avochato for WhatsApp integration cannot be used with a HIPAA compliant use-case at this time.

Yes. The Avochato API allows your team to programmatically send Avochato messages, as well as manage contact information including ePHI securely.

In order to securely use the Avochato API, you must make API requests using HTTPS to https://www.avochato.com, and you must protect the security of the responses and any logs or copies of responses of privileged data you receive via the Avochato API.

However, optionally integrating the Avochato API into third party services (such as Zapier) or using our webhook features to securely send information to third-party services will require a BAA with any vendors involved, and will require diligence to limit the ePHI transmitted to any third-parties using the principle of least privilege.

Note: the above is not official legal advice from Avochato. We recommend consulting with legal counsel when setting up SMS communications at your practice.

Our 2023 HIPAA report is available upon request. Please contact help@avochato.com or text us at (415) 214-8977 for a copy.