HIPAA at Extables

1. Key terms

• Protected health information (PHI): individually identifiable health information, such as a patient’s name together with a diagnosis, treatment, claim or insurance details. Electronic PHI is called ePHI.
• Covered entity: a health plan, health care clearinghouse or health care provider that handles PHI electronically, as defined by HIPAA.
• Business associate: a company that creates, receives, stores or sends PHI on behalf of a covered entity or another business associate.
• Business Associate Agreement (BAA): the contract between a covered entity (or business associate) and its business associate that sets out how PHI is protected.

When your organization signs a BAA with us, Extables acts as your business associate for the PHI you store in the covered parts of the service. Extables is not itself a covered entity.

2. Who can use Extables for PHI

HIPAA support is available only to customers on the Enterprise plan who have a signed BAA with Extables. Free and other paid plans are not covered, and PHI must not be stored in accounts on those plans.

If your organization is a covered entity or a business associate and you want to store PHI in Extables, contact sales before you add any patient data.

3. How to get a BAA

• Contact our sales team at extables.com/contact-sales and tell us you need a BAA.
• Tell us which Extables accounts and workspaces will hold PHI. The BAA covers only the accounts and workspaces named in it.
• We send you our BAA to review. It is signed by an authorized person at your organization and by Extables.
• We confirm in writing when HIPAA coverage is active for your account. Do not add PHI before you receive that confirmation.

To add more accounts or workspaces later, contact sales again; they are covered once we confirm them in writing. The BAA covers PHI from the date it takes effect, not PHI that was stored in Extables before then.

4. Features you must not use for PHI

The BAA covers PHI that you store in the records, fields, comments and file attachments of your covered workspaces. The following parts of Extables send data outside our own systems or show it to people outside your team, so PHI must not be put in them, even with a BAA:

• Nextinn AI, including AI fields, AI chat, AI app building and every other AI feature. AI requests are processed by third-party AI providers that are not covered by our BAA. Do not run AI on tables that contain PHI.
• Third-party integrations and connections, such as Google Sheets sync, webhooks and any app or service you connect through the API. Data you send to another service is governed by your own agreement with that service.
• Automation emails and notifications. Do not put PHI in the subject, body or attachments of emails that automations send, and do not send PHI to email addresses outside your organization.
• Public links. Do not share views, interfaces, portals or forms containing PHI with “anyone with the link”, and do not use public forms to collect PHI from patients.
• Names and descriptions. Do not put PHI in the names or descriptions of workspaces, bases, tables, fields, views or automations, because these are shown more widely than records.
• Support. Do not send PHI to our support team through the support chat, email or tickets. If we need to look at a record to help you, we will ask how to do that safely.

If PHI is put into any of these features, it is outside the protection of the BAA, and your organization is responsible for that disclosure.

5. How we protect your data

• All traffic to extables.com is encrypted with HTTPS (TLS), and browsers are told to always use a secure connection.
• Passwords are stored only in a strongly protected one-way form, never in readable form. Repeated sign-in attempts are limited to slow down password guessing.
• Email addresses must be verified before an account can be used, and signed-in sessions expire automatically.
• Bases can only be opened by people who have been given access, and attached files can only be opened by signed-in users. Uploaded files are served in a way that stops them from running as part of our site.
• Our servers are protected by network security controls, and administrative access to them is restricted to a small number of authorized staff.
• We take backups of the service, including your records and files, and check them for integrity.

We keep improving these safeguards. Your BAA sets out our specific obligations to you.

6. Your responsibilities

HIPAA compliance is shared between you and us. Your organization is responsible for:

• Deciding what PHI you need to store in Extables, and storing only the minimum necessary.
• Keeping PHI only in workspaces covered by your BAA, and following the rules in section 4.
• Giving access only to people who need it, at the lowest access level that lets them do their work.
• Reviewing who has access to your covered workspaces regularly, and removing people as soon as they leave your organization or change roles.
• Making sure each person uses their own account with a strong password that is not used anywhere else. If you sign in with Google, turn on two-step verification for those Google accounts.
• Training your staff on your HIPAA policies and on the features that must not be used for PHI.
• Telling us right away at support@extables.com if you think someone has accessed your account or your PHI without permission. Do not include PHI in that message.

7. If something goes wrong

If we discover a breach of unsecured PHI in a covered workspace, we will notify you as required by HIPAA and by your BAA, and we will work with you to investigate and limit the harm.

8. Leaving Extables

You can export your records to CSV at any time. When your BAA or subscription ends, your PHI is returned or deleted as set out in the BAA.

9. Questions

This page explains how HIPAA works at Extables. It is not legal advice, and it does not replace your BAA. If this page and your BAA differ, the BAA applies. Ask your own compliance or legal team whether Extables fits your HIPAA program.

To request a BAA, contact sales at extables.com/contact-sales. Other questions: support@extables.com.