HIPAA and Business Associate Statement

Our role

When an agency uses Clovina Health to schedule visits, verify them, and document care, the agency is a covered entity (or a business associate of one) and Clovina Health is a business associate. We create, receive, maintain, and transmit protected health information (PHI) only to provide the service, as permitted by our agreement with the agency, and as required by law.

A signed Business Associate Agreement (BAA) is available to every customer on request and before any live client data is entered. Contact support@clovinahealth.com to execute one.

Permitted uses of PHI

We use and disclose PHI only:

• to perform the services described in the customer agreement;
• for our own proper management and administration, or to carry out our legal responsibilities;
• as required by law.

We do not sell PHI, use it for marketing, or use it to train third-party models.

Safeguards we maintain

Administrative

• Role-based access control — office staff, clinical staff, caregivers, and family users each see only what their role permits.
• Every record is scoped to a single agency; cross-agency access is blocked at the database level.
• Workforce access to production is limited, individually assigned, and reviewed.
• Security and HIPAA awareness training for personnel with access.

Technical

• Encryption in transit (TLS) and encryption at rest.
• Authentication with per-user credentials; no shared logins.
• Audit logging of record access and administrative actions, including who verified or approved a visit and when.
• Automatic session handling and password reset controls.

Physical

• PHI is stored with our cloud infrastructure providers in SOC 2 audited data centers in the United States. We do not store PHI on employee devices.

Electronic visit verification and location data

GPS coordinates are captured at clock-in and clock-out to verify that a visit occurred at the client's location, which is required by the 21st Century Cures Act for Medicaid personal care and home health services. Location is not collected between visits. Verification records, including geofence exceptions and approvals, are retained and auditable.

Minimum necessary

Access within the platform follows the minimum-necessary principle. Caregivers see only the clients and visits assigned to them. Family users see only what the agency explicitly enables for them. Billing users see visit and payment records, not full clinical documentation, unless their role grants it.

Subcontractors

We use subcontractors — cloud hosting, database, transactional email, payment processing, and error monitoring providers. Any subcontractor that may access PHI is bound by a written agreement imposing the same restrictions and conditions that apply to us.

Breach notification

If we discover a breach of unsecured PHI, we will notify the affected agency without unreasonable delay and no later than 30 calendar days after discovery. Notice will include, as available, the individuals affected, the PHI involved, what happened, and the steps we are taking. The agency remains responsible for notifying individuals, HHS, and the media where required.

Individual rights requests

Requests for access to, amendment of, an accounting of disclosures of, or restriction on PHI should be directed to the agency that maintains the record. We will make the relevant information available to the agency within a reasonable time so it can meet its HIPAA deadlines.

Return or destruction of PHI

On termination, we will return or destroy PHI where feasible, as described in the customer agreement and Privacy Policy. Where destruction is not feasible, protections continue for as long as we retain the information.

Contact

HIPAA, BAA, or security questions: support@clovinahealth.com