HIPAA readiness & gap checklist
Last updated: August 8, 2026
The short answer
HIPAA is not a website checkbox. It applies to covered entities — healthcare providers, health plans and clearinghouses — and to the business associates working on their behalf. Simply Mindfull Moments sold directly to people for their own self-care, with no treatment relationship and no insurance billing, generally falls outside HIPAA entirely.
What does govern Simply Mindfull Moments today: the FTC Act's prohibition on deceptive claims, the FTC Health Breach Notification Rule, and state health-data laws including Washington My Health My Data, Nevada SB 370 and CCPA/CPRA. Those are the rules behind the privacy policy, your privacy rights and the consumer disclosures.
Protected health information vs. consumer health data
“Not covered by HIPAA” does not mean unprotected. Health information falls into two different legal buckets, and what you write in Simply Mindfull Moments sits firmly in the second one.
Protected health information (HIPAA)
Information held by a healthcare provider, health plan or clearinghouse — or by a vendor working on their behalf. Used directly by you for your own self-care, Simply Mindfull Moments is none of those, so what you record here is generally not protected health information.
Consumer health data (state law)
Your mood check-ins, journal entries and anything else you record about your mental wellbeing. This is protected — by Washington My Health My Data, Nevada SB 370, CCPA/CPRA and similar state acts, plus the FTC Act and the FTC Health Breach Notification Rule.
What the difference means for you
- You get either way: access to your own data, a portable export, deletion, withdrawal of consent, no sale, no targeted advertising, and opt-in consent before sensitive data is processed.
- HIPAA would add: a Notice of Privacy Practices, an accounting of disclosures, amendment rights, and provider-side obligations such as workforce training and signed agreements with every vendor in the path.
Simply Mindfull Moments would become covered if a licensed clinician delivered treatment through it, if we engaged with an employer health plan as its business associate, or if insurance were billed. Those triggers and the gaps we would close are listed in the HIPAA readiness & gap checklist.
When HIPAA does apply
Three things turn Simply Mindfull Moments into a covered relationship. Any one of them is enough.
You act as a business associate
An employer health plan, insurer or healthcare provider contracts Simply Mindfull Moments to handle data on their behalf.
What changes: A signed BAA with that entity, plus flow-down BAAs with every vendor that could touch the data.
Licensed clinicians deliver treatment
Consultations move from general wellbeing support to diagnosis, treatment or care plans by licensed clinicians.
What changes: Session notes become protected health information, with patient rights, retention rules and audit logging.
You bill insurance
Simply Mindfull Moments submits claims, or works with a clearinghouse, for any service a member receives.
What changes: Simply Mindfull Moments becomes a covered entity for that line of business, including a Notice of Privacy Practices.
Quick self-check
Answer these before signing
- Does a contract name Simply Mindfull Moments as a business associate, subcontractor or subprocessor to a health plan or provider?
- Will a licensed clinician document diagnosis, treatment or clinical recommendations inside Simply Mindfull Moments?
- Will Simply Mindfull Moments or a partner submit or process insurance claims for a member?
- Will Simply Mindfull Moments receive member data directly from an employer's health plan rather than from the member?
- Will Simply Mindfull Moments transmit health information to a vendor that has not signed a BAA?
A single yes means treating the relationship as covered and starting the BAA signature workflow before any data moves.
Readiness checklist
Where Simply Mindfull Moments stands against the HIPAA Security and Privacy Rules. Status labels describe intent and current engineering state — they are not an audit result, certification or attestation.
Administrative
- Documented security risk analysisNeeded if covered
A written analysis of where health data lives, who can reach it, and the likelihood and impact of each risk, reviewed at least annually.
- Designated privacy and security officerNeeded if covered
One named person accountable for policies, requests and incidents.
- Workforce training and sanctions policyNeeded if covered
Role-based training at onboarding and annually, with a written consequence for misuse.
- Incident response runbookPartial
Simply Mindfull Moments has an internal escalation path; a covered relationship needs written severity tiers, evidence capture and decision owners.
Technical
- Encryption in transit and at restAlready in place
All traffic is served over HTTPS and the managed database encrypts stored data.
- Access controls and least privilegeAlready in place
Row-level security scopes each record to its owner, and organization reporting only ever returns aggregates.
- Audit logging of every health-data accessPartial
Organization report access is logged today; a covered relationship needs read-level logging for every record and role.
- Session timeouts and re-authenticationNeeded if covered
Idle session expiry and re-authentication before sensitive actions.
- Backup, restore and recovery testingPartial
The managed database is backed up; restore drills and a documented recovery time objective are still needed.
Organizational
- Signed BAA with every vendor touching health dataNeeded if covered
Hosting, database, email delivery and any support tooling in scope. Payments stay out of scope while they only process merchandise and subscriptions.
- Subcontractor flow-downNeeded if covered
Each vendor must hold equivalent agreements with its own subprocessors.
- Vendor inventory and review cadencePartial
The vendor list exists; a periodic review with security questionnaires is not formalized.
Documentation
- Notice of Privacy PracticesNeeded if covered
A separate notice from the consumer privacy policy, given at first contact and acknowledged.
- Patient rights processPartial
Export and deletion tools already exist; access, amendment and accounting of disclosures need HIPAA-specific timelines.
- Retention and disposal scheduleNeeded if covered
Six-year retention for required documentation, with secure disposal steps.
- 60-day breach notification runbookNeeded if covered
Templates and decision criteria for notifying individuals, the covered entity and regulators.
If a covered relationship starts
- 1
Freeze the data flow
No health information moves into a new context until the agreements below are signed.
- 2
Sign the upstream agreement
Execute the BAA with the covered entity and record the effective date.
- 3
Run the vendor signature workflow
Collect BAAs from every vendor in scope using the existing onboarding steps.
- 4
Pause non-compliant vendors
Any vendor that will not sign is removed from the path or replaced before launch.
- 5
Publish the notice and close the gaps
Issue the Notice of Privacy Practices, turn on full audit logging, and complete the risk analysis and training.
Partners and organizations can start at for organizations, where reporting stays aggregate-only.
Not legal advice
This page is a working checklist, not legal advice, and it is not a claim of HIPAA compliance or certification. Confirm your own obligations with qualified counsel before entering a covered relationship.
Questions about scope or agreements: partners@simplymindfullmoments.org