HIPAA & Business Associate Agreement Disclosure

HIPAA Ready Infrastructure

TrunkFlow AI is built on HIPAA ready architecture using BAA eligible vendors and security controls consistent with HIPAA administrative, physical, and technical safeguard requirements.

Business Associate Agreement (BAA)

BAA availability by plan tier:

• Agency tier: BAA included at no additional charge.
• Clinic tier: BAA available upon request. Contact trunkflowai@gmail.com to request a BAA for your organization.
• Solo tier: Independent contractors who are covered entities or business associates are responsible for their own HIPAA compliance. A limited BAA rider may be available upon request.

What Our BAA Covers

All PHI processed, stored, or transmitted through TrunkFlow AI's BAA covered infrastructure: session notes and documentation, patient identifiers and treatment goals, GPS and EVV data from field therapy visits, and billing codes connected to documentation records.

BAA Eligible Infrastructure Vendors

• Supabase, Inc. — Primary data storage, authentication, and database layer.
• Amazon Web Services (AWS) — Cloud hosting, backup storage, and compute (BAA available).
• Stripe, Inc. — Payment processing (does not receive clinical data).
• Mapbox, Inc. — GPS routing (location data stripped of patient identifiers).

Limitations and Responsibilities

No software platform is independently "certified" as HIPAA-compliant by HHS. Compliance is a shared responsibility. Covered entities remain responsible for their own compliance programs, workforce training, and risk analysis.

Breach Notification

In the event of a breach of unsecured PHI, TrunkFlow AI will notify affected subscribers without unreasonable delay and in no case later than 60 days after discovery, as required by the HIPAA Breach Notification Rule.

Requesting or Updating a BAA

To request a BAA or ask about our compliance program: trunkflowai@gmail.com
TrunkFlow AI, LLC · Seattle, Washington, USA