HIPAA & data handling

How Studio fits with your practice’s HIPAA obligations.

Studio plans your office’s technology. It is not designed to receive, store or transmit protected health information (PHI), and you should not enter any.

What that means for you

• Use practice-level details only: names, NPI, rooms and equipment
• Remove patient names and charts from any photos before uploading
• Studio is not a business associate unless we sign a separate BAA

How plans support compliance

Plans separate patient-record networks from guest Wi-Fi, keep cameras out of treatment areas, and include encrypted backups and battery protection. These support the HIPAA Security Rule’s safeguards but don’t replace your own risk assessment.

Security

Data in transit is encrypted with TLS. Stored plans are encrypted at rest and access is limited to staff who need it to deliver your plan.