What we use
The strongest protection against a data breach is not holding the data. ComplyWell reads only the fields a compliance requirement actually depends on.
| What we use | What it is for |
|---|---|
| A patient identifier | To tell one patient's deadlines from another's. A code works as well as a name. |
| Start of care, visit, and where applicable death dates | Every deadline in hospice is counted from one of these. |
| Ordered disciplines and assigned clinicians | To know which visits are required, and who to notify. |
| Documentation status | To know whether a note has been completed and signed. |
| Clinician contact details | To send the reminder to the right person. |
How long we keep it
| What | How long |
|---|---|
| The export your EMR sends | Not kept. Each file is read, fingerprinted and discarded. The fingerprint proves what the file contained and holds no patient information. |
| Findings ledger — the patient identifier, the dates, the rule, the citation, the sentence we sent and the fields from your own export that produced it | Kept while you are a client |
| Workflow run history containing patient information | Not retained — disabled at the platform level |
| Record of every brief sent — what was sent, to whom and when | Kept while you are a client |
| Audit records (no patient information) | 6 years |
| When your contract ends | All patient information deleted within 30 days, confirmed to you in writing |
You may request deletion of your agency's data at any time. It is completed within 30 days and confirmed in writing. A scheduled purge of anything past its retention period runs every January and July.
Safeguards
- Encrypted in transit and at rest. Patient information is never sent by unencrypted email or text.
- Credentials issued by us. Every account is created by ComplyWell for one named person and revoked by ComplyWell when that person leaves. There is no self-registration.
- Unique accounts only. No shared logins, on any system, ever.
- Least privilege. Each account holds the minimum permission needed, reviewed every six months.
- Audit record of every action taken on your data — what, when, by whom, and the outcome. Retained six years and reviewed quarterly.
- Read-only. ComplyWell evaluates your data. It does not write back to your medical record.
- Documented security risk assessment using the HHS Security Risk Assessment Tool, reviewed at least annually and after any material change.
Notifications carry the minimum
A reminder sent to a nurse contains the patient code and the task that is due. It does not contain a diagnosis, and it does not contain a full name where a code will serve. The clinician already knows who their patient is.
Who else touches your data
Any vendor that could come into contact with patient information operates under a signed Business Associate Agreement with ComplyWell. If the agreement is not signed, the data does not flow. No exceptions, including during a pilot.
| Vendor role | Patient information? |
|---|---|
| Workflow automation — runs the compliance rules | Yes — under agreement |
| Email delivery — sends notifications | Yes — under agreement |
| Text delivery — where your agency enables it | Yes — under agreement |
| Documentation review — where your agency enables it | Yes — under agreement |
| Website and client portal delivery | Portal only — under agreement |
| Website source code hosting | No — never |
If something goes wrong
We have a written incident response procedure. In summary:
- Within 1 hour of discovery — contain it, preserve the evidence, open an incident record.
- Within 24 hours — establish what was involved and whose, and tell you an incident is under investigation.
- Within 5 days — complete the four-factor risk assessment the Breach Notification Rule requires, and document the conclusion.
- Formal written notice to you without unreasonable delay, and no later than 60 days from discovery. California requires the most expedient time possible, and we treat 60 days as an outer limit rather than a target.
Every incident is recorded and retained six years — including those determined not to be breaches, along with the reasoning.
California
ComplyWell is based in San Diego. California's Confidentiality of Medical Information Act applies to us as a contractor in addition to HIPAA, and it is stricter. We hold ourselves to the California standard for every agency we serve, not only Californian ones.
Patient requests
Patient rights — access, amendment, an accounting of disclosures — are exercised through your agency, not through us. We hold information on your behalf and maintain no designated record set. If a patient contacts us directly, we neither confirm nor deny that we hold their information, refer them to you, and notify you the same business day. Where you need our help to answer a request, we respond within 10 business days so you can meet your own deadline.
Scope of the service
ComplyWell is a support tool. It is not clinical advice, not legal advice, not a medical record, and not a guarantee of survey outcome. Your agency remains fully responsible for meeting the Conditions of Participation. We tell every agency this at onboarding, and we design for it — which is why an interruption to our service is an inconvenience to you rather than a compliance failure.
Want the full policy set?
Our complete HIPAA Policies and Procedures document — covering access control, technical safeguards, retention, vendor management, incident response, training, and contingency planning — is available to any agency evaluating ComplyWell, along with our most recent security risk assessment.
Request the full documentationLast updated 20 August 2026. See also our Privacy Policy and Terms of Service.