HIPAA & Health-Data Notice

CareCompass is a software service operated by Mindful Me, LLC. This notice describes CareCompass's current HIPAA-readiness status and the rules clinicians must follow, based on whether their workspace has been explicitly authorized for PHI.

1. What CareCompass currently is, and is not

CareCompass is a collaboration and organizational tool for clinicians. CareCompass does not make a blanket representation that every workspace or use of the service is HIPAA compliant; PHI use is limited to explicitly authorized contexts subject to applicable safeguards and contractual requirements. Vague language such as "HIPAA-friendly" or "HIPAA-ready" should not be interpreted as certification, attestation, or a substitute for an executed BAA where one is required.

2. Current CareCompass security measures

The following controls are in place today and are described here so clinicians can assess CareCompass on its actual controls, not on aspirational language:

• encryption in transit (HTTPS) for all traffic;
• encrypted, private Amazon RDS PostgreSQL storage with backup and deletion-protection controls;
• row-level security enforcing per-user access to data;
• multi-factor authentication (MFA) for clinicians, with server-side assurance-level checks;
• trusted-device controls;
• secure respondent links that exchange raw bearer values for short-lived HttpOnly/Secure browser sessions and use no-store and no-referrer protections;
• server-side authorization for privileged operations, including policy-acceptance recording and subscription creation;
• audit logging of administrative and sensitive actions;
• minimum-necessary caregiver/respondent transactional email through Paubox for approved workflows, with clinical narrative excluded from invitation email content;
• consent-bound caregiver/respondent SMS through Notifyre for approved workflows, including delivery-status handling and STOP-based local opt-out/revocation controls;
• role separation between the administrative Owner role and clinician access;
• payment processing delegated to Stripe so CareCompass never receives or stores full card numbers.

No system can be guaranteed absolutely secure, and these controls do not, on their own, make CareCompass HIPAA compliant.

3. HIPAA-readiness work in progress

Mindful Me, LLC continues to work toward the operational, administrative, and contractual requirements needed to support PHI more broadly for external clinicians. Today, PHI may be used only inside a workspace and workflow that has been explicitly authorized for PHI. The current production architecture uses AWS for the clinical runtime, database, clinician identity/MFA, secrets, encryption, logging, and backups. Approved caregiver/respondent invitation email uses Paubox. Production caregiver/respondent SMS through Notifyre is enabled only for the approved consent-bound SMS path; automated weekly SMS remains disabled. External clinical AI processing remains separately gated. Authorized internal Mindful Me, LLC workforce access is governed by our own internal authorization, while an external customer clinician workspace additionally requires that any applicable BAA and operational requirements for that workspace are satisfied. Outside an explicitly authorized workspace and workflow, clinicians must treat CareCompass as a non-PHI environment.

4. BAA status

PHI may be used only in a clinician workspace that CareCompass has explicitly authorized for PHI. Authorized internal Mindful Me, LLC workforce access (for example, the Owner/Admin role) is handled separately and is not itself a customer Business Associate Agreement (BAA). For an external, customer clinician workspace, PHI authorization additionally requires that any applicable BAA requirement for that workspace has been satisfied. Nothing on this page constitutes an executed BAA for your workspace, and no clinician should infer that a BAA exists for them absent individual confirmation from CareCompass. If you have not been individually notified that your workspace is PHI-authorized, none exists for you, and you must not enter PHI. When we extend PHI authorization to additional external clinician workspaces, we will confirm the applicable BAA status directly to them and update this notice with an effective date.

Extending PHI and BAA authorization to additional external clinician workspaces is also contingent on Mindful Me, LLC confirming that all relevant subprocessors listed in the Privacy Policy have BAAs in place where PHI would flow.

5. Clinician responsibilities

Your obligations under HIPAA, state law, and your professional licensure are independent of CareCompass. You remain responsible for:

• determining what constitutes PHI in your practice and keeping it out of CareCompass unless your workspace is explicitly authorized for PHI, including out of AI prompts;
• obtaining any authorizations, consents, or releases from clients and, for minors, guardians before using CareCompass to organize information about them, even in de-identified form, noting that such consent does not by itself authorize entering PHI or client-identifying information into a workspace that has not been explicitly authorized for PHI;
• practicing data minimization, enter only what you actually need for clinical organization; and
• maintaining your own privacy and security safeguards for your practice, including for any records you keep outside CareCompass.

6. No emergency use, crisis vs. immediate danger

CareCompass is not an emergency-response service and does not monitor entries in real time. Entering information into CareCompass does not contact a clinician, crisis responder, emergency service, or law-enforcement agency.

• For mental-health crisis support in the United States, call or text 988 (Suicide and Crisis Lifeline).
• For immediate danger or a medical emergency, call 911. 988 is a crisis support line, not a substitute for emergency services when someone is in immediate danger.

7. Breach and security contact

If you believe your CareCompass account has been compromised, or you suspect a data-security issue, contact CareCompass immediately at andrea@andreagoundrycounseling.com with the subject line "Security." Include only the information necessary to describe the issue; do not include client-identifying information.

8. Notifications

When PHI use is extended to additional external clinician workspaces and the applicable BAA becomes available, CareCompass will notify affected clinicians by email and in-app announcement, and this notice will be updated with an effective date and version.

9. Contact

Questions about this notice or the HIPAA-readiness work? Contact andrea@andreagoundrycounseling.com.