HIPAA Notice

FLOR is designed to handle Protected Health Information ("PHI") in a manner consistent with the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and the HITECH Act. This notice summarizes our safeguards and your obligations. You must read and acknowledge this notice before using FLOR with PHI.

Business Associate Agreement (BAA)

FLOR enters into a Business Associate Agreement with covered entities and business associates that handle PHI through the Service. Contact baa@flor.app to request or confirm a BAA. Do not enter PHI into FLOR until your BAA is in place.

Administrative safeguards

• Workforce access on a need-to-know basis with documented role assignments.
• Annual security and HIPAA training for personnel.
• Incident response and breach notification procedures.
• Vendor risk reviews and BAAs with subprocessors that touch PHI.

Technical safeguards

• Encryption in transit: TLS 1.2+ for all client and server traffic.
• Encryption at rest: AES-256 on the storage layer.
• Authentication: Single sign-on via Google with session protections.
• Authorization: Row-level access controls so users can only see their own workspace's data.
• Audit logs: Sign-in, access, and administrative events are logged.

Physical safeguards

Production data is hosted in SOC 2-audited cloud facilities with physical access controls, redundant power, and environmental monitoring.

Breach notification

If we determine a reportable breach has occurred, we will notify affected covered entities without unreasonable delay and within the timeframes required by HIPAA and applicable state law.

Your obligations as a user

• Maintain the confidentiality of your sign-in credentials.
• Only enter PHI into FLOR if your organization has a BAA with us.
• Only record audio when you have legal authority and have given any required notice.
• Review every AI-generated draft for accuracy before clinical use.
• Report suspected breaches to security@flor.app immediately.

Patient rights

Individuals' rights under HIPAA (access, amendment, accounting of disclosures) flow through your covered entity. FLOR will assist your covered entity in responding to such requests as set out in the BAA.

Contact

HIPAA / Privacy Officer: privacy@flor.app