Security, HIPAA and BAA Overview

StoriiCare is built to hold protected health information (PHI). This article explains how we protect your data, how our Business Associate Agreement (BAA) works, and the settings your team controls to keep records secure.

• HIPAA: StoriiCare acts as your Business Associate and signs a BAA with its US customers.

• SOC 2 Type II: our security controls are independently audited.

• ISO 27001:2022: certified information security management system.

• Cyber Essentials Plus: UK government-backed certification.

• GDPR: supported for our UK and European customers.

Under HIPAA, your organization is the Covered Entity and Storii, Inc. (trading as StoriiCare) is your Business Associate. Our standard BAA is included with your StoriiCare agreement. Among other things, it commits us to:

• Use PHI only to provide StoriiCare's services to you.

• Maintain administrative, physical and technical safeguards in line with the HIPAA Security Rule.

• Notify you of any breach of unsecured PHI, as required by HIPAA.

• Hold any subcontractor that handles PHI to the same restrictions.

• Return or destroy your PHI when our agreement ends, at your choice, except where the law requires us to keep it.

To get a copy of your signed BAA, or if your organization needs to use its own BAA, contact your account manager or support@storii.com.

• Secure hosting: StoriiCare runs on Amazon Web Services (AWS).

• Encryption: data is encrypted in transit and at rest.

• Access controls and audit logging: every action in StoriiCare is tied to the staff member who was logged in.

• Testing: regular penetration testing and vulnerability scanning, with findings fixed within set timeframes.

• Backups and disaster recovery: backups are regularly verified, and our disaster recovery plan is tested at least once a year.

• Our team: multi-factor authentication on our internal systems, regular security training, and access to customer data limited to what's needed to support you.

The main StoriiCare app needs an internet connection by design. An EHR that works offline has to store PHI on the device itself, so a lost or stolen phone or tablet could expose participant records. StoriiCare is tested to work on slow and weak connections instead. The only exception is the HomeCare app, which can record EVV home visits offline and syncs when the connection returns.

Skye, StoriiCare's AI assistant, is built with Anthropic and runs within our HIPAA-compliant environment. Your data and your participants' PHI are not used to train AI models. Skye's answers are drafts for your staff to review, not decisions.

Conversations with the AI Support Agent are logged so our team can review them. Share only the participant details needed to solve your question.

HIPAA security is shared: we secure the platform, and your team controls who can see what. We recommend reviewing these settings during setup and at least once a year:

• One login per person. Never share logins. Accurate logins keep your audit trail meaningful. See Using StoriiCare Safely.

• Permission levels. Give each staff member only the access their role needs. See Configuring Staff Roles & Permission Levels.

• Assign participants to staff. Limit staff to the participants they work with. See How to Assign Participants to Staff.

• Session timeout. StoriiCare logs users out after 30 minutes of inactivity by default; Super Users can change this. See Session Time & Logging Out.

• Hide sensitive fields. Use "Click to Reveal" on Face Sheet fields such as Social Security, Medicaid or insurance numbers. See How to Edit the Face Sheet Template.

• Remove leavers promptly. Remove staff profiles on someone's last day. See How to Remove a Staff Profile.

• Protect the master account. Keep the master password secure and the Super User up to date. See How to Reset the Master Password and How to Change the Super User.

• Lock shared devices. On shared iPads, lock the device to StoriiCare. See Locking Devices for StoriiCare Use Only (Apple iOS).

• Handle exports carefully. PDFs and CSVs you download contain PHI. Store them securely and delete them when you no longer need them.

Customers and prospective customers can request our SOC 2 Type II report, ISO 27001 certificate and security documentation for vendor reviews or security questionnaires. Contact your account manager or support@storii.com.

If you think a login has been compromised, a device with StoriiCare access has been lost, or PHI may have been shared with the wrong person, tell us straight away at support@storii.com or +1 650 924 9930. Reset any affected passwords and follow your own organization's incident procedures.

• Using StoriiCare Safely: Login, Sessions, and Best Practices

• A Guide to Staff Roles

• StoriiCare Privacy Policy