How your records are protected.
Every line on this page is a fact you can ask us to demonstrate. None of it is a compliance claim.
Last updated 26 September 2026
The five things the rules actually name
The federal Security Rule names five technical safeguards for electronic health records. It is the clearest checklist anyone has published, so here it is, with what this software does for each. Nothing below is a compliance claim.
| What the rule names | What the software does |
|---|---|
| Access control Unique accounts, automatic logoff | Roles you name yourself, with every capability a switch. One account per person, so the record says who did what. Sitting idle signs you out after two hours, on the desk and on the treatment room iPad |
| Audit controls Record and examine activity | Two records, not one. One logs who looked at a client. The other logs who changed something, with the before and the after, and a reason |
| Integrity Protect records from improper alteration | A signed clinical note can never be edited. A correction is a dated, signed addendum. What a client signed is frozen exactly as it was signed, so changing a phone number cannot rewrite the form somebody put their name to |
| Authentication Verify who is who | Named accounts, sessions that expire, and lockout after repeated failed sign-ins. You can require that a new phone or laptop is approved before it opens the CRM, whatever the password |
| Transmission security Protect information in transit | Every connection is over HTTPS, enforced rather than offered |
In a lot of systems an administrator can quietly edit a signed note. Here nobody can, including us. The clinical record was built around that rule from the first day.
What we do beyond the checklist
- Encrypted off-site backups, every day. Encrypted before they leave the server, with the key held separately, so the company storing them holds nothing readable
- Approved devices, when you want them. A switch, off to begin with so nobody is locked out on day one. Turn it on and a new device has to be allowed in before it can be used, with the list yours to manage
- Every permission is a switch, including what a person can see. The calendar, client records, clinical notes and money are each their own permission, set per role or for one person, and enforced where the data is served rather than by hiding a button
- Warnings never block. An off-grid time or a double booking is flagged and still allowed. The person in the room is the one who knows
- A payment method's identity never changes, so a figure in a report two years from now still means what it meant when it was recorded
Which rules apply to a med spa
Less obvious than most owners expect.
The federal rules may not reach you at all
HIPAA applies to a health care provider who transmits health information electronically in connection with a transaction covered by the federal rules. Those transactions are a fixed list and every one of them runs between a provider and a health plan: a claim, an eligibility check, a prior authorization, a remittance.
Keeping records in a system is not one of them. A client signing an intake form on an iPad is not one of them. An appointment reminder is not one of them. A spa that never sends anything electronically to a health plan may not be a covered entity at all.
A transaction someone conducts on your behalf counts, so a billing service checking eligibility counts. And one transaction, ever, is enough.
State law applies either way
Most states protect medical information regardless of whether anyone bills a health plan, and several protect it more strictly than the federal rules do.
- California reaches providers of health care and the businesses holding medical information for them
- Washington lets a resident bring a claim directly
- Nevada and Connecticut have their own consumer health data laws
- Texas defines a covered entity more broadly than the federal rules
Which one applies depends on where your client is, not where you are. Rather than doing the minimum in each state, we hold to the strictest standard that applies anywhere, for every spa on the system.
We do not claim HIPAA compliance or certification, and we never will. There is no certificate to hold, and no spa was ever made compliant by the software it bought. Compliance is a property of how you run your business. What software can do is not get in your way, and keep the evidence, and this one does both.
Which rules reach your spa is a question for your attorney, not for a vendor's marketing page. The paragraphs above are the test, not advice about your situation.
Who else touches your records
| Who | What for |
|---|---|
| Amazon Web Services | The servers the software runs on, and sending its email |
| Cloudflare | The domain, protecting the connection, encrypted off-site backups, forwarding email sent to us, and counting visits to this website |
Nobody else. No advertising network, no data enrichment, no marketing platform. We do not sell your records and we do not use them for advertising.
This website counts page visits with Cloudflare Web Analytics, which sets no cookies and does not follow anyone between sites. Nothing of the kind runs inside the software. What a spa does in MD Spa Mentor is not measured, reported or sent anywhere.
The full picture is on the Privacy Policy.
If something goes wrong
If we find a problem
We tell the affected spa promptly and plainly: what we know, what we do not yet know, and what we are doing about it.
If you find one
Tell us at [email protected]. Reports from security researchers are welcome and are answered by a person.
Business Associate Agreement
Every spa accepts a Business Associate Agreement before it can use the software. The owner reads it and accepts it at sign-up, and the software will not open a single screen until they have. Your accepted copy, and the date you accepted it, stay available to you.