When we handle protected health information for a covered-entity customer, Oli Health acts as its HIPAA Business Associate. This page summarizes how we protect practice and patient data and how to request detailed compliance information.
Request Compliance Information
Last updated: July 13, 2026
Protecting health information shapes how we host and encrypt data, control production access, prepare for recovery, and govern AI features.
Oli Health runs on managed enterprise cloud infrastructure. Production workloads use managed infrastructure and data services covered by Oli Health’s agreements with its providers.
Production data is encrypted at rest and in transit. Credentials use managed secret storage, and service connections use encrypted channels.
Only authorized staff can use secured administrative paths to reach production systems. Staff do not access patient data on local devices, and production access is logged.
We run scheduled backups and regularly test restore integrity. Critical production systems have 24-hour recovery-time and recovery-point targets unless a customer agreement requires stricter commitments.
AI services process patient data only when a customer uses an AI feature. Approved providers are contractually prohibited from using identifiable protected health information to train third-party foundation models.
Before Oli Health relies on a third party, we review its security posture, data handling, and role in the service. The review determines the contractual safeguards and minimum-necessary controls required for that use.
We assess the vendor’s security posture, data handling, hosting arrangements, and role in the service before approving a new data flow.
We document whether the vendor’s role requires a Business Associate Agreement or other contractual safeguards for the proposed use.
Approved vendors receive only the data required for their specific role, with controls tailored to the service path they support.
We review vendor reliance on a schedule and when the product, data flow, or vendor relationship materially changes.
This documented process keeps vendor access deliberate, limited to its approved purpose, and subject to ongoing review.
Want to go deeper? These government sources provide official context for the HIPAA, PIPEDA, and state and provincial privacy topics that inform Oli Health’s approach.
Official HHS guidance on HIPAA Business Associate responsibilities.
Official HHS overview of breach-notification obligations.
Official HHS guidance for using cloud services under HIPAA.
The federal Canadian privacy law governing personal information, from the Office of the Privacy Commissioner.
Overview of provincial and territorial privacy regimes that may apply alongside PIPEDA.
California’s consumer privacy law, an example of state regulations that may apply alongside HIPAA.
Related reading: Security & Compliance features · Privacy Policy · Terms of Service · Contact Us
Need our HIPAA Attestation, BAA information, or help with a security concern?
Email our Security & Compliance team
Or write directly to security@olihealth.ai