For US practices, Stillpoint includes a HIPAA mode: a Business Associate Agreement you accept in the app, a PHI audit log, and a summary of how your data is protected. These are the vendor's part of HIPAA. Your own policies, training, and day-to-day habits are the rest.
HIPAA mode is US-only. Practices outside the US still get encrypted data handling but don't need the formal HIPAA framework.
Open the page
Navigate to Settings → Compliance. The page is organized into tabs: Status, Audit Log, Retention, and Encryption. Only owners and admins can open it.
Business Associate Agreement (BAA)
The BAA is the legal agreement between your practice (the Covered Entity) and Stillpoint (the Business Associate) governing how Protected Health Information is handled.
Accept the BAA
- Open the Status tab.
- Click Review & Accept BAA.
- Read the agreement.
- Enter your Covered Entity name if it differs from your practice name.
- Click Accept.
Once accepted, the page shows the BAA version, the acceptance date, and the person who accepted it. HIPAA-mode features (audit log, retention preference, encryption details) become available.
You can re-read the BAA any time via View Agreement, and download it as a PDF.
Audit log
The audit log records PHI activity in the app, such as viewing, editing, and exporting clinical notes and intake forms. Each entry shows:
- When it happened.
- Who did it (their practitioner name, or their account name or email). Access by Stillpoint support is labelled Stillpoint support, including when support acted as someone on your team.
- Action (view, insert, update, delete, export).
- Record type and record ID.
Filter the log by action, record type, and date range from the Audit Log tab.
Retention preference
The Retention tab lets you record how long your practice intends to keep PHI records (5, 6, 7, or 10 years). It is saved for your own records only: Stillpoint does not delete anything automatically when the period ends.
How long you must keep medical records is set by your state and profession. HIPAA's own six-year rule covers compliance documentation. Check with your compliance officer for the requirement that applies to you.
Encryption and security
The Encryption tab summarizes how your data is protected:
- Data is encrypted at rest with AES-256 (AWS KMS) and in transit with TLS 1.2 or later.
- SOAP notes are encrypted again in the app (AES-256-GCM) before they are stored.
- Four roles (owner, admin, practitioner, scheduler) decide who sees what. Schedulers can't open clinical records.
- Two-factor authentication and passkeys are available for every account, and sessions lock after 15 minutes idle.
- Automated backups are kept for 35 days.
Tips
- Accept the BAA before storing PHI in Stillpoint.
- Ask everyone on your team to turn on two-factor authentication or a passkey. It is optional, not enforced.
- Review the audit log periodically to monitor access patterns.
- The BAA must be accepted by an owner or admin.