Security & HIPAA
Last updated: October 6, 2026
Is Emma HIPAA compliant?
Emma is currently HIPAA-ready, not represented as HIPAA compliant by default. For production environments involving protected health information (PHI), we work with the healthcare organization to activate the required security configuration, confirm applicable Business Associate Agreements, review integrations and data flows, and complete deployment-specific safeguards before PHI is processed.
HHS guidance makes clear that HIPAA readiness is not simply a software toggle: organizations handling electronic PHI may need appropriate safeguards, risk analysis, and Business Associate Agreements in place.
Business Associate Agreements
If Emma creates, receives, stores, processes, or transmits PHI on behalf of a clinic, the legal entity operating Emma acts as the clinic's Business Associate and enters into a Business Associate Agreement (BAA). We also maintain BAAs with subprocessors that handle PHI, such as voice infrastructure providers.
"HIPAA-ready" means
Our platform is designed with healthcare privacy and security in mind and can be configured for HIPAA-aligned deployments. However, actual HIPAA compliance depends on the complete production environment, including agreements, access controls, audit logging, encryption, risk assessments, incident response, workforce training, and verification of every integration that touches PHI.
TCPA compliance
Emma is designed for TCPA-compliant patient outreach. We support documented consent for calls and texts, National Do Not Call scrubbing, time-of-day guardrails, clear opt-out paths, and retained call records for compliance.
Because telephone consumer protection rules depend on your specific use case and jurisdiction, TCPA settings are reviewed and configured during onboarding before any live outbound engagement begins.
Demo and evaluation data
Until required contracts and controls are active, Emma uses synthetic data only and does not process production PHI. Please do not include real patient information in demo or contact forms.
Questions?
If you have any questions about security or HIPAA, please reach out through our Contact page.