Know the scope.
Ask for the evidence.

HIPAA responsibilities
follow the data.

For a PHI-enabled pilot, the required BAA comes before patient information. Review the data flow, permitted use, relevant service providers and safeguards alongside your organization’s risk analysis and workforce practices. A BAA alone does not establish that the full program is complete.

• Define permitted information, users and access responsibilities.
• Review handling, retention, export and closure expectations.
• Verify the applicable environment and service agreements.
• Agree incident handling, recovery and an accountable contact.

Payment processing
has its own scope.

Determine where card information is entered, transmitted and handled, and which party is responsible for each part of the flow. Using an outside processor does not by itself remove PCI DSS responsibilities. Applicable validation depends on the implemented payment channel and the requirements of the payment partners.

The public DMEStudios showcase does not collect card details. Discuss the accepted payment workflow separately from patient intake, documents and general notes.

Read the report.
Understand what it covers.

SOC 2 examinations address controls relevant to security, availability, processing integrity, confidentiality or privacy within a defined scope. Ask which service is covered, what period was examined, what exceptions were identified and which responsibilities remain with the customer.

A provider’s report does not automatically cover every application built on that provider. No independently issued DMEStudios SOC 2 report has been verified for publication here. References to HIPAA, PCI DSS and SOC 2 explain the evaluation; they do not represent certification, validation or attestation of this product.