HIPAA — agreements, where PHI goes, and the go-live checklist¶
The one place for the practice's compliance posture of the fax automation. The technical controls are in SECURITY.md; this page is the inventory a privacy officer reads.
Business Associate Agreements¶
| Vendor | What it touches | Agreement | Status |
|---|---|---|---|
| Google Cloud (the service runs here) | The fax pages and their text (Document AI, Vertex AI Gemini), the filed values, review cases and notices on the data bucket, the logs (ids and counts only), the secrets | The Google Cloud Platform HIPAA Business Associate Agreement, accepted under the project's Cloud terms: https://cloud.google.com/terms/hipaa-baa | Accepted by the practice. Record here the date and the account that accepted it: ______ |
| Elation Health (the EHR, system of record) | The fax inbox the system reads; the reports and lab values it files; the charts it creates for unmatched patients | The practice's agreement with Elation as its EHR vendor; the API is used under it, with the practice's own OAuth client | Confirm the EHR BAA covers API access: ______ |
| Spruce Health (staff messaging) | Internal notes to staff about faxes: counts, document types, Elation report ids and links; for an imaging report, the report's Findings and Impression in the patient's own thread. Never a message to a patient | The practice's agreement with Spruce; API use under the organization's token | Confirm the Spruce BAA covers API use, and review the Spruce table in SECURITY.md with the privacy officer before the communication mode leaves off: ______ |
| Cloudflare (the staff bookmark and the documentation site) | No PHI. The staff address is a Worker that only redirects the browser to the app on Google Cloud during clinic hours (302); the browser then talks to Google directly and every page with values is served from there. After hours the Worker serves its own static "clinic closed" page and fetches nothing. It sees the address typed into it and, on a force-load, the force token — never a page, a fax or a value. The documentation site holds no PHI |
None needed | Settled (verified in the Worker's source, 2026-10-12). Rule: the Worker stays redirect-only; it must never be changed into a proxy |
Covered Google services in use: Cloud Run, Cloud Storage, Secret Manager, Document AI, Vertex AI (Gemini on the global endpoint), Cloud Logging, Cloud Scheduler, Artifact Registry, Cloud Build. Each is on Google's list of HIPAA covered products at the time of writing; re-check the list on the BAA page whenever a new Google service is added. Google AI Studio and developer API keys are never used for PHI — Vertex AI only.
The Google Workspace and Cloud Identity HIPAA implementation guide the practice keeps locally is in the repository's
hippadocs/ folder (not published).
Where PHI goes, and for how long¶
| Place | What is there | How long |
|---|---|---|
| Elation | The system of record: the report with the values and the fax pages, on the patient's chart | Elation's retention |
Data bucket (fax-data) |
Fax records (values and dates by Elation ids, never names), review cases (test names, units, values, specimen — never demographics), journeys, the inbox ledger, the parsed fax kept for a retry, the inbound fax PDF kept so a filing can be reproduced (the fax explorer's "Download original", sign-in required), the notices with their states; each Elation environment in its own folder | Fax records and cases until the practice clears them; a parsed fax up to 7 days; the fax PDF up to 30 days; a notice's text at most 72 hours (4 days by the bucket rule) |
| Cloud Logging | Ids, counts, statuses and reasons. Never a name, a value tied to a patient, a fax number or the words of a note — a test in the suite reads every log line for this | Logging's retention |
| Spruce | Internal notes to staff (see the table above) | Spruce's retention; the practice can delete a note |
| Document AI, Vertex AI | The fax pages and text while a request runs; no training on the practice's data under the Cloud terms | Not stored by the service |
| The operator's computer | Sample faxes used for testing, in the operator's own Downloads folder | Never in the repository, never on the documentation site |
Controls, in one list¶
- Sign-in on the fax app (password shared out of band); the staff gate; the app is closed outside clinic hours.
- Every page says so on sign-in: authorized staff only, PHI, use is logged.
- Secrets in Secret Manager only (Elation, Spruce, the poll token); none in the repository.
- No patient name on any screen of the fax app; the chart is in Elation.
- The communication module posts internal notes only; it has no function that messages a patient; one step up at a time (off, dry run, pilot, live), with hourly and daily limits.
- Two Elation environments (sandbox and live) with separate data; an older version of the service can never point at the live EHR by accident.
- A clean slate of an environment keeps the deleted objects restorable for the bucket's soft-delete window only.
- Tests enforce: no PHI in logs, no secrets in responses, no network to Spruce from the test suite.
Before polling is switched on against the live Elation¶
- [ ] Google Cloud BAA recorded above (date, account)
- [ ] Elation BAA confirmed to cover the API
- [ ] Spruce BAA confirmed to cover the API; the Spruce table in SECURITY.md reviewed with the privacy officer
- [ ] The staff gate still redirects (it never proxies) — see the Cloudflare row above
- [ ] The practice's HIPAA policies and the risk analysis list this system, its vendors and the people who sign in
- [ ] Staff who use it have read their manual (fax owner, doctor) and know whom to tell when something looks wrong
- [ ] The sign-in page shows the PHI notice (it does from the 2026-10-12 version)
Still open on the technical side¶
From SECURITY.md's Phase 4: customer-managed encryption keys on the data bucket, a PHI-redacted log sink, default-deny network egress, and the audit log. Tracked in PLAN.md; none of them changes what the tables above say about where PHI goes.