Which Catalyst components are covered for HIPAA when my app stores protected health information (PHI)?

The Catalyst HIPAA Compliance help page names Catalyst CloudScale Data Store as the component upgraded to store ePHI, with Catalyst DevOps Logs included by extension, and CloudScale Stratus buckets have a PII/ePHI setting for storing sensitive data in compliance with HIPAA. The Profiles and Permissions and Audit Logs settings were upgraded to restrict and record access to that data.

Other components aren’t described there as HIPAA features. What your own code does with PHI, for example in Serverless Functions, AppSail or Job Scheduling, is your responsibility: Catalyst requires developers to use its HIPAA features and to follow all applicable privacy and data protection laws.

Before you send PHI to any other component, such as Zia Services or QuickML, or to confirm what a Business Associate Agreement (BAA) covers, contact Catalyst support. Include the components you use, your data center, your pricing model and whether a BAA is already in place, so one answer covers all of them.

Refer to the HIPAA Compliance help page for details.