HIPAA, the Health Insurance Portability and Accountability Act of 1996, is a federal law that establishes requirements for protecting the privacy and security of certain health information. The HIPAA Privacy, Security, and Breach Notification Rules apply to covered entities and, as applicable, their business associates.

What rights do individuals have under HIPAA?

HIPAA gives individuals certain rights regarding their Protected Health Information (PHI). These include, with certain limitations, the right to access and obtain copies of their health information, request amendments, receive information about certain disclosures, request restrictions on certain uses and disclosures, and file a complaint if they believe their HIPAA rights have been violated.

Who must comply with HIPAA?

HIPAA applies to covered entities and, as applicable, their business associates. Covered entities generally include health plans, health care clearinghouses, and health care providers that conduct certain health care transactions electronically. Business associates are individuals or organizations that perform certain functions or services for a covered entity involving the use or disclosure of Protected Health Information (PHI). Business associates may also use subcontractors that handle PHI, which are subject to applicable HIPAA requirements.

What information is protected under HIPAA?

HIPAA protects individually identifiable health information that is created, received, maintained, or transmitted by a covered entity or its business associate and meets the definition of Protected Health Information (PHI). PHI can include information about an individual's health or medical condition, health care services, payment for health care, medical records, billing information, and other identifiable health information.

Can an organization become HIPAA certified?

There is no official HIPAA certification issued or recognized by the U.S. Department of Health and Human Services (HHS). Private organizations may offer HIPAA assessments or certifications, but these do not constitute an official HHS certification. Organizations subject to HIPAA are responsible for complying with the HIPAA requirements applicable to their role and maintaining appropriate safeguards for Protected Health Information.

How does Mojo Helpdesk support HIPAA compliance?

Metadot maintains administrative, physical, and technical safeguards designed to protect the confidentiality, integrity, and availability of Protected Health Information (PHI) processed through covered Mojo Helpdesk services. These safeguards include, as applicable, access controls and authentication, multi-factor authentication and role-based access controls, encryption of PHI in transit and at rest, security logging and monitoring, vulnerability management and security patching, backup and disaster recovery procedures, and periodic evaluation of security controls. Customers are responsible for configuring and using Mojo Helpdesk appropriately for the nature and sensitivity of the PHI they choose to process and for determining whether their use of the Service complies with their HIPAA obligations.

Does Mojo Helpdesk encrypt PHI?

Yes. Protected Health Information processed through covered Mojo Helpdesk services is encrypted in transit and at rest. Metadot also maintains access controls, authentication, logging and monitoring, and other administrative, physical, and technical safeguards designed to protect PHI.

HIPAA · Compliance

Health data handled with real safeguards, not just a promise.

How Mojo Helpdesk supports compliance with the Health Insurance Portability and Accountability Act, so teams handling protected health information can run support without putting patient privacy at risk.

Business Associate Agreement availableFor customers on our Enterprise Plan, our standard Business Associate Agreement (BAA) is available to support the processing of Protected Health Information (PHI). Contact us to request a BAA.

Safeguards: Administrative, physical & technical
Agreement: BAA available
Standard: HIPAA Security Rule

There is no official HIPAA “certification.”

Metadot maintains administrative, physical, and technical safeguards designed to protect PHI and comply with applicable HIPAA requirements. Subcontractors that create, receive, maintain, or transmit PHI on Metadot’s behalf are required to agree to applicable restrictions, conditions, and requirements concerning PHI. Metadot provides its standard Business Associate Agreement (BAA) for customers on our Enterprise Plan.

A “certified” badgeNot recognized

“We paid for a HIPAA certificate.”

HHS does not recognize private HIPAA certifications. A logo is not accountability.

“We maintain safeguards designed to protect PHI and provide our standard BAA for customers on our Enterprise Plan.”

Documented safeguards, appropriate requirements for subcontractors handling PHI, and a Business Associate Agreement for customers on our Enterprise Plan.

Our HIPAA commitment

Four ways we safeguard PHI.

The safeguards that keep protected health information protected, and the standard behind each one.

How medical data is protected

Protected Health Information (PHI) is protected using administrative, physical, and technical safeguards, including encryption in transit and at rest.

STANDARD · Encryption in transit & at rest

Who can access it

Access to Protected Health Information (PHI) is restricted through authentication, access controls, and role-based permissions.

STANDARD · MFA & role-based access

The standard we follow

Metadot maintains reasonable and appropriate administrative, physical, and technical safeguards designed to protect the confidentiality, integrity, and availability of electronic Protected Health Information (ePHI) and complies with applicable requirements of the HIPAA Security Rule.

STANDARD · HIPAA Security Rule

Who else is held to it

Subcontractors that create, receive, maintain, or transmit Protected Health Information (PHI) on Metadot’s behalf are required to agree to applicable restrictions, conditions, and requirements concerning PHI as required by the HIPAA Rules.

STANDARD · Subcontractor requirements

Business Associate Agreement

A BAA when your compliance needs one.

For customers on our Enterprise Plan, Metadot Corporation provides its standard Business Associate Agreement (BAA) to support the processing of Protected Health Information (PHI) through Mojo Helpdesk. The BAA describes Metadot’s obligations for the use, disclosure, safeguarding, and handling of PHI in connection with the covered Services.

To request our standard BAA or discuss HIPAA requirements for your Enterprise Plan, please contact us.

Frequently asked questions

Run support that respects patient privacy.

Use Mojo Helpdesk to support workflows involving Protected Health Information (PHI), with our standard Business Associate Agreement (BAA) available for customers on our Enterprise Plan.

Try for free Book a demo