Compliance (HIPAA)

Go to Settings → Compliance for HIPAA-related tracking and documentation.

Business Associate Agreements (BAAs)

Track which vendors you've signed BAAs with. For each vendor, record:

• •Vendor name and category (Database, Payments, Hosting, AI, Email, Telehealth, SMS, Other)
• •BAA status (Signed, Requested, Not Started, Expired, Not Required)
• •Signed date and expiry date
• •Notes

Tendly suggests known subprocessors (Supabase, Stripe, Vercel, Anthropic, Resend, Daily.co, Twilio) that you should have BAAs with. The dashboard shows summary cards for total tracked, signed, and needing attention.

Breach Log

Document and track any security incidents as required by HIPAA:

• •Title, description, severity (Low to Critical), status
• •Discovery date, affected individuals count
• •Whether PHI was involved, reported to HHS, or individuals notified
• •Root cause and corrective actions

The system shows deadline warnings (e.g. the 60-day individual notification requirement).