Amplify supports HIPAA-aligned workflows on all plansOrganizations that handle patient information need communication tools that prioritize privacy, security, and accountability. Amplify is designed to support HIPAA-aligned workflows by providing secure document delivery, access controls, and audit visibility across fax and secure communication channels. However, HIPAA compliance is a shared responsibility. While Amplify provides technical and administrative safeguards, your organization is responsible for how the platform is configured and used.
Business Associate Agreement (BAA)
To use Amplify in a HIPAA-compliant manner, your organization must have a Business Associate Agreement (BAA) in place. A signed BAA outlines Amplify’s responsibilities as a service provider and clarifies how protected health information (PHI) is handled, safeguarded, and reported.HIPAA-aligned features are only intended for use once a BAA is executed and your internal policies support compliant usage.
Using Amplify in a HIPAA-compliant way
Once a BAA is active, Amplify can be used to support HIPAA’s Privacy Rule and Security Rule, provided your organization applies appropriate operational controls. Amplify helps by offering:- Secure fax delivery
- Encrypted document access for recipients
- Role-based user permissions
- Audit logs and activity tracking
- Secure portals for document viewing
What counts as PHI?
Understanding what qualifies as Protected Health Information (PHI) helps determine how and where information should be shared.| Always PHI | Sometimes PHI | Not PHI |
|---|---|---|
| Patient name with identifiers | Appointment reminders tied to a patient | Office hours |
| Medical records or test results | Follow-up requests | General announcements |
| Diagnoses or treatment details | Care coordination messages | Educational content |
| Insurance or billing details | Contextual identifiers | Public contact information |
Communication channels and compliance considerations
Amplify offers multiple delivery channels. Each has different compliance considerations depending on the type of information shared.Fax and Secure Fax
- Designed for healthcare document exchange
- Supports secure transmission and audit visibility
- Suitable for PHI when used according to internal policies
Secure Email and Secure Links
- Documents are shared via encrypted access links
- Recipients do not need an account
- Access controls such as expiration and authentication can be applied
Secure SMS
- Intended for notifications or limited document sharing
- Requires patient consent
- PHI should be minimized
Your organization is responsible for determining what information is appropriate for each channel.
AI-powered features and HIPAA considerations
Amplify includes AI-assisted features such as AI Chat, document summaries, and template generation to help teams work more efficiently. AI features can be used in HIPAA-aligned workflows when:- Patient awareness
Patients are informed when AI-assisted tools are used in document processing or communication. - Minimum necessary use
Only the required information is processed to complete a task. - Access controls
AI-generated outputs are only accessible to authorized users. - Internal documentation
Your organization documents the decision to use AI features and associated safeguards.
AI tools analyze document content but do not modify original records unless explicitly saved by a user.
Audit logs, visibility, and accountability
Amplify provides audit-friendly visibility to help organizations meet HIPAA accountability requirements, including:- Delivery status tracking
- User activity logs
- Timestamps for sent and received documents
- Centralized access to fax and document history
Third-party integrations
Any third-party systems connected to Amplify—such as external storage, analytics tools, or downstream systems—are not automatically covered under your Amplify BAA. Your organization is responsible for ensuring:- Appropriate agreements are in place
- Data shared with third parties is compliant
- Risks are documented internally
Session management and access security
To help reduce unauthorized access, Amplify enforces session controls and supports secure access practices. Organizations may also apply:- Device-level auto-lock policies
- Strong password requirements
- Internal access reviews
FAQs
Is Amplify HIPAA compliant by default?
Is Amplify HIPAA compliant by default?
Amplify provides HIPAA-aligned features, but compliance depends on having a signed BAA and using the platform according to your internal policies.
Can we use AI features with PHI?
Can we use AI features with PHI?
Yes, if used responsibly. Your organization must ensure patient awareness, limit data to the minimum necessary, and document safeguards internally.
Who is responsible for HIPAA compliance?
Who is responsible for HIPAA compliance?
HIPAA compliance is shared. Amplify provides technical safeguards, while your organization controls configuration, access, and usage.