HIPAA Compliance

Overview

Thyra is built for clinical environments where privacy, security, and reliability are mandatory. This HIPAA Compliance Statement describes how Endo Mind, Inc. approaches HIPAA aligned safeguards for the Thyra platform. This statement is a summary and does not replace the Business Associate Agreement (BAA) or other agreements with Customers. When there is a conflict, the executed agreement controls.

How Thyra Fits into HIPAA

Customers may be Covered Entities under HIPAA. When we create, receive, maintain, or transmit Protected Health Information (PHI) on behalf of a Covered Entity, Endo Mind acts as a Business Associate and will execute a BAA where required. PHI is used and disclosed only as permitted by the BAA, HIPAA, and applicable law. We do not use PHI for advertising. Customers are responsible for determining whether HIPAA applies to their use case and for configuring workflows, permissions, and policies consistent with their obligations.

Administrative Safeguards

• Security governance. We maintain policies and procedures designed to protect PHI and sensitive Customer Content. Access to systems is limited to personnel with a need to know.
• Workforce training. Team members with access to production systems are trained on security and privacy expectations appropriate to their role.
• Risk management. We perform periodic risk assessments and maintain a process for remediation and continuous improvement.
• Incident response. We maintain an incident response process designed to identify, contain, investigate, and remediate security incidents.
• Vendor management. We assess and monitor key vendors that may handle Customer Content and require appropriate contractual protections.

Physical Safeguards

• Facility controls. Production infrastructure is hosted in controlled data centers operated by reputable cloud providers with physical access controls.
• Device controls. Company devices used to access production systems are managed with security controls such as encryption, strong authentication, and remote wipe where feasible.

Technical Safeguards

• Access control. Role based access, least privilege, and strong authentication are used to restrict access to the Services and Customer Content.
• Encryption. Data is protected in transit using industry standard encryption. Encryption at rest is used for stored data where supported by the underlying infrastructure.
• Audit controls. We maintain logs that record access and key actions within the platform to support monitoring, investigation, and compliance needs.
• Integrity controls. We use controls designed to protect data from improper alteration or destruction, including backups and monitoring.
• Transmission security. We use secure protocols for data transmission and configure integrations to minimize unnecessary exposure.

Audit Trails and Traceability

Thyra is designed so actions are traceable. Audit events may include logins, record access, task routing events, and administrative changes, subject to configuration and the Customer's environment. Customers can use audit information to support compliance, investigations, and continuous improvement of clinical workflows.

Breach Response and Notification

We investigate suspected security incidents promptly and work with Customers to determine whether an incident constitutes a reportable breach under HIPAA. When a BAA applies, breach notification timelines and procedures follow the BAA and HIPAA requirements. Customers remain responsible for notifying patients and regulators where required, and we support Customers with the information needed for that process.

Subcontractors and Downstream Vendors

When we use subcontractors that may access PHI, we require them to sign agreements that impose appropriate HIPAA aligned obligations, including safeguards and breach reporting. We limit subcontractor access to the minimum necessary to provide their service.

Data Location and Backups

The Services are intended for use in the United States. Hosting regions, backups, and redundancy may be defined in the Customer Agreement. We maintain backup and recovery processes designed to support availability and resilience.

Patient Rights and Customer Responsibilities

Patients have rights under HIPAA with respect to their PHI. Customers are responsible for responding to patient requests for access, amendments, and accounting of disclosures as required by law. Where the platform supports these workflows, we provide tooling to help Customers fulfill obligations. Customers remain responsible for policy and process.

Security Reporting

Customers should report suspected security issues to support@thyrahealth.com. Do not include PHI in an email if it is not necessary.

Changes to This HIPAA Compliance Statement

We may update this statement as the platform evolves. We will update the last updated date when changes are made.

Contacting Us

For HIPAA and security questions, contact support@thyrahealth.com.

Endo Mind, Inc. Delaware, United States.