HIPAA Guidelines for Customers

This page explains how HIPAA applies when you use the Platform to build or run applications that may involve Protected Health Information (PHI). It describes what our platform covers under our Business Associate Agreement (BAA), what it doesn't, and what you're responsible for as a Covered Entity or Business Associate under HIPAA. In this page, "we", "us" and "our" mean Blocks AI Inc., the business associate under the BAA.

This is a shared responsibility model: we secure the underlying infrastructure and services we control, but because you can build custom apps and connect your own integrations, you control how PHI flows through what you build.

These guidelines describe how the BAA applies to your use of the platform. If this page conflicts with your BAA, your BAA controls. This page is not legal advice.

Core hosting infrastructure – our managed servers, containers, and networking for apps you build or deploy through the platform

Primary database and storage services we provide natively (e.g., our built-in database, file storage) when PHI is stored in designated, encrypted data stores

Authentication and access control features built into the platform

Audit logging of platform-level access to your workspace and data (logging of end-user activity inside the apps you build is your responsibility)

Pre-built apps that we have officially designated in writing as HIPAA-eligible, and only when used according to their documented configuration. An app is not covered simply because it is available on the platform. Coverage applies only to the specific apps we have expressly identified as HIPAA-eligible.

Data encryption in transit and at rest for the services listed above

All third-party integrations or APIs you connect or enable yourself (payment processors, email/SMS providers, analytics tools, external AI/ML services, etc.). This includes integrations that are available, listed, or offered directly within the platform. Simply because an integration is accessible or pre-configured within the platform does not mean it is covered; it is out of scope unless we've separately confirmed in writing that it is covered.

Vet and obtain your own BAAs for any third-party service, plugin, or API you connect to your app if that service will touch PHI, including integrations listed in the platform as supporting HIPAA (see "Third-Party Integrations Listed as Supporting HIPAA" below).

Support channels (support tickets, chat, email and screen-shares). Don't share PHI with our support team unless we have agreed a secure channel with you in advance.

Public or shareable app links/demo environments – these are not intended for PHI and are not covered

Any pre-built app not explicitly designated as HIPAA-eligible

Free-tier, sandbox, staging, trial environments, or any plan other than a plan with a HIPAA-enabled workspace. HIPAA coverage under our BAA is only available to customers with an active HIPAA-enabled workspace; no other plan tier includes HIPAA-covered infrastructure, regardless of the features or environments used.

Custom code you write yourself that transmits data outside our infrastructure (e.g., calling an uncovered external API, writing to an unapproved third-party database)

Any field, table, or component you've configured to store PHI outside of our designated secure storage – for example: custom database tables or fields you create outside the designated HIPAA-covered data store, environment variables or config files used to pass PHI between components, local/browser storage or client-side caching within an app you build, spreadsheet or CSV exports generated by your app, log fields or debug outputs that capture user-submitted data, and file uploads directed to a non-designated storage bucket or third-party file service.

Some integrations available in the platform may be labeled, described, or listed as supporting HIPAA (for example, "HIPAA-ready" or "HIPAA-eligible"). Such a label only indicates that the third-party provider offers a HIPAA-eligible service or account type. It does not mean that the integration is in scope under our BAA, or that your account with that provider is configured to support HIPAA.

If you connect such an integration to an app that creates, receives, stores, or transmits PHI, you are solely responsible for:

1.opening and maintaining an account with the provider on a plan or tier that supports HIPAA;

2.entering into a BAA directly with the provider before any PHI is sent to it;

3.enabling and maintaining any HIPAA-specific settings or configurations the provider requires; and

4.connecting the integration using the credentials of that HIPAA-enabled account, and not through default, shared, or platform-managed credentials, or any other account that is not covered by your BAA with the provider.

We do not verify the type of account you hold with any third-party provider, whether you have a BAA with that provider, or how your account is configured. Once data leaves our infrastructure and is sent to a third-party provider, it is outside the scope of our BAA, even if the provider is listed as supporting HIPAA.

If you're not sure whether something is covered, don't put PHI there, ask us first.

If PHI ends up somewhere that isn't covered, tell us promptly at privacy@blocks.diy so we can help you remove it. We don't monitor the content you put on the platform, so we can't prevent this for you.

1.Only store or process PHI within HIPAA-enabled workspaces and the HIPAA-eligible services listed above.

2.Vet and obtain your own BAAs for any third-party service, plugin, or API you connect to your app if that service will touch PHI.

3.Configure access controls appropriately – apply role-based access, strong authentication, and least-privilege principles to any app you build.

4.Not use public sharing, demo links, or non-production environments for apps that handle PHI.

5.Train your workforce on proper handling of PHI within apps they build or use on the platform.

6.Report any suspected security incident or breach involving PHI on our platform to us promptly via security@blocks.diy. You remain responsible for your own notification obligations under HIPAA.

7.Review app configurations before going live to confirm PHI only flows through covered components.

8.Maintain your own HIPAA compliance program (risk assessments, policies, workforce training) independent of our platform-level safeguards.

1.Maintain administrative, physical, and technical safeguards for the covered services listed above

2.Encrypt PHI in transit and at rest within covered services

3.Maintain audit logs of platform-level access

4.Notify you of any breach of unsecured PHI within our covered services, per the timeframes set out in your BAA

5.Maintain and disclose our list of subprocessors that may handle PHI, and assure we have entered into agreements with them that include the same, or substantially similar, restrictions and conditions on PHI that apply to us under your BAA

6.Not use PHI to train AI models

7.Not use or disclose PHI in covered services other than as permitted by your BAA or required by law