HIPAA

Details on how Blue handles Protected Health Information (PHI) in accordance with HIPAA regulations.

Last updated: April 12, 2026

1. Introduction

This HIPAA Compliance page explains how Bloo, Inc. (“we”, “us”, or “Blue”) protects the privacy and security of Protected Health Information (PHI) in accordance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and its implementing regulations. This page applies to our platform at blue.cc when used to handle PHI.

This page supplements our Terms of Service, Privacy Policy, and Data Processing Agreement. For the contractual obligations governing PHI, see our Business Associate Agreement.

2. Definitions

  • Protected Health Information (PHI): Any information about health status, provision of health care, or payment for health care that can be linked to a specific individual.
  • Covered Entity: Health care providers, health plans, and health care clearinghouses that transmit health information electronically.
  • Business Associate: A person or entity that performs certain functions or activities that involve the use or disclosure of PHI on behalf of, or provides services to, a Covered Entity.

3. Our Role

Blue acts as a Business Associate to Covered Entities when our platform is used to handle PHI. We are committed to complying with HIPAA regulations in this capacity.

4. PHI We May Handle

As a Business Associate, we may handle various types of PHI, including but not limited to:

  • Patient names
  • Addresses
  • Dates (birth, admission, discharge, etc.)
  • Phone numbers
  • Email addresses
  • Medical record numbers
  • Account numbers
  • Health plan beneficiary numbers

5. Use and Disclosure of PHI

We will only use or disclose PHI as permitted by our Business Associate Agreement with the Covered Entity and in compliance with HIPAA regulations. This may include:

  • Providing our process management platform services
  • Conducting data analysis to improve our services
  • Performing system maintenance and troubleshooting

We will not use or disclose PHI for marketing purposes or sell PHI unless explicitly authorized by the Covered Entity and the individual.

6. AI and Automated Scanning

Blue’s automated compliance scanning systems may process metadata associated with PHI (including file names, file sizes, upload dates, and file types) for the purposes of Terms of Service enforcement, abuse detection, and platform safety. Automated scanning systems do not access or process the contents of files containing PHI. All enforcement decisions related to accounts covered by a Business Associate Agreement are made by humans.

For details on Blue’s general content scanning practices, see Section 5.4 of our Privacy Policy and Section 10.4 of our Terms of Service.

7. Data Security Measures

We implement robust security measures to protect PHI, including:

  • Enterprise-level encryption (AES-256) for data at rest and in transit
  • Advanced monitoring and alert systems
  • Multi-factor authentication (MFA) for backend systems
  • Regular third-party security audits
  • Daily data backups
  • Collaboration with external security researchers

8. Employee Training and Access

All our employees receive regular training on HIPAA compliance. Access to PHI is restricted to authorized personnel on a need-to-know basis.

9. Data Retention

We retain PHI only for as long as necessary to provide our services or as required by law. Upon termination, PHI is deleted from active systems within 90 days and from backups within 90 days of deletion from active systems, consistent with our Data Processing Agreement.

10. Data Storage and Transfer

PHI is stored encrypted at rest in EU data centers (Germany). All data processing infrastructure is located within the European Union. We ensure appropriate safeguards are in place and comply with all applicable laws and regulations for any data transfers.

11. Breach Notification

In the event of a breach of unsecured PHI, we will notify affected Covered Entities without unreasonable delay and in no case later than 60 calendar days after discovery of the breach, as required by HIPAA. For data breaches subject to GDPR, the notification timeline set forth in the Data Processing Agreement (72 hours) applies.

12. Individual Rights

We will assist Covered Entities in fulfilling their obligations to provide individuals with their rights under HIPAA, including:

  • Right to access their PHI
  • Right to request amendments to their PHI
  • Right to an accounting of disclosures
  • Right to request restrictions on use and disclosure of their PHI
  • Right to request confidential communications

Individuals should contact their healthcare provider (the Covered Entity) to exercise these rights.

13. Business Associate Agreements (BAAs)

As a Business Associate, Blue is committed to entering into Business Associate Agreements (BAAs) with Covered Entities as required by HIPAA. A signed BAA must be in place before any PHI is processed through our platform.

To request a BAA, contact [email protected]. Our team will respond within 2 business days.

Please note:

  • We use a standard BAA template that has been reviewed by our legal team for HIPAA compliance.
  • Any modifications to our standard BAA may require additional review and approval.
  • We recommend that you have the BAA reviewed by your own legal counsel before signing.

14. Changes to This Policy

Changes to this HIPAA Compliance page are governed by Section 19 of our Terms of Service.

15. Contact Us

If you have any questions about this HIPAA Compliance page, our data practices, or our BAA process, please contact:

Emanuele Faja, CEOEmail: [email protected]