Security, HIPAA and 42 CFR Part 2
How Cima keeps your clients' records safe.
We run a licensed substance use treatment program on the same rules, so we built them in: a Business Associate Agreement with every practice, encryption, two-step sign-in, a log of every chart view, and releases that check the client's consent first.
The agreement
A Business Associate Agreement at sign-up, not on request
Every practice accepts the BAA when it signs up, and Cima records the version, the time and who accepted it. What it commits us to:
Use only to serve you
We use your records only to run the service, and only the minimum needed. We never sell them, use them for marketing, or use them to train AI models for anyone else.
The same terms down the line
Each company that handles records for us signs the same restrictions: our cloud host (AWS, including its AI service), our claims clearinghouse and the e-prescribing network.
We tell you fast
A breach of unsecured records is reported to you within 5 business days of discovery, with what we know, so you can meet your own notice duties.
Part 2 terms included
For substance use records, we act as a qualified service organization, fully bound by 42 CFR Part 2, and resist any demand for them that Part 2 doesn't allow.
Your records leave with you
When the service ends, your records stay available to export for at least 90 days. Then we return or destroy them.
Read it first
The BAA, Terms and Privacy Policy are public. They're drafts under review by our attorney, and the reviewed versions replace them before they bind anyone.
The Business Associate Agreement →Where your records live
In the US, encrypted, kept apart from every other practice
| What | How Cima does it |
|---|---|
| Hosting | Cima's own Amazon Web Services account in the US, under AWS's Business Associate Addendum, using only HIPAA-eligible AWS services. It's separate from the systems of the treatment program we run. |
| Encryption | Every connection uses HTTPS. The server's disk and every backup are encrypted with keys in AWS Key Management Service. |
| Kept apart | Each practice has its own database file. Cima takes the practice from your signed-in session, never from the request, and a test proves one practice can't see another's records. |
| Backups | Every night, a copy of every practice's database and chart files goes to encrypted, versioned storage, kept for 6 years. |
| The server | Open only to web traffic. Our administrators reach it through AWS Systems Manager, not an open remote login. |
| Texts and email | Texts go out through AWS's messaging service under the same agreement, only to clients who agreed, and never say what a visit is for. Paperwork emails carry a link, never health information. |
| AI note help | Runs on AWS's HIPAA-eligible AI service (Amazon Bedrock) under the same agreement. It's off until the practice owner turns it on. |
| Your subscription | Stripe handles your card. It sees your practice's name, the owner's email and the number of clinicians, never client information. |
| Calendar sync | Google and Apple don't sign BAAs, so the private calendar feed shows only the kind of visit, or initials if you choose. Never a name. |
Who gets in
Two-step sign-in for everyone, with no exceptions
- Passkeys: Face ID, Touch ID, Windows Hello, a phone or a security key. Two factors in one tap, and they can't be phished.
- Or a password and a 6-digit authenticator code. Passwords are at least 10 characters and stored only as a salted hash. The owner can switch this option off once everyone has a passkey.
- Five wrong tries lock the account for 15 minutes. Sessions end after 30 idle minutes, and after 12 hours at most.
- Staff join by an invite link that expires in 7 days. The owner can reset a lost phone; an owner's own reset goes through our support with a call-back check.
- Every note signature asks for the clinician's PIN again.
- Every sign-in, failed try, invite, role change and sign-in setting change is recorded, and those records can't be changed.
Minimum necessary
Each person sees what their job needs
Roles are enforced by the server, not just hidden on the screen.
Clinicians
Their own clients: their caseload and anyone on their calendar. A supervisor also sees a supervisee's note waiting for their co-sign.
Billing
Insurance, claims and payments for every client. Never the text of a note, and never screening results.
Front desk
The calendar, client details and payments. No notes.
Owner
Everything, plus the settings, the reports and the access log. Reports show totals, not client names.
The record
A log of every chart view, and notes that can't be quietly changed
- Every chart view, print, export, release and signature is logged with who, when and why.
- The log can only be added to. Each entry is chained to the one before, so Cima can show the log is intact.
- The owner can print a chart's audit trail with the chart, for a surveyor or an investigation.
- Signed notes are locked by the database itself. Each signature carries a fingerprint of the note, rechecked to prove nothing changed.
- Nothing is deleted. A mistake is marked "entered in error"; a correction is a dated addendum.
- Forms a client signs on their phone are kept exactly as sent.
42 CFR Part 2 and client rights
Releases check the consent before anything goes out
- A signed release names the recipient, the purpose and an end date. Records go outside the practice under a current release, the client's own request, or another legal basis you name (like a court order or a medical emergency). An expired or revoked release stops the send.
- For substance use programs, every release carries the federal notice to the recipient (42 CFR 2.32).
- A client who paid in full and asked that their health plan not be told: the claim is blocked.
- Every release outside the practice goes on the client's list of disclosures, ready to print when they ask.
- Requests for copies or changes run on their deadlines (Texas gives 15 business days for copies), and a denied change keeps the client's statement with the record.
- Legal holds, a keep-until date for each chart, and each staff member's privacy training on file.
Your data
Yours to take, any time
Download the whole practice in one file: every client, visit, note with its signatures, medication, claim, payment and the access log. Or one client's whole chart as a PDF, or their full record as data when they ask for it electronically. Each download is logged. If your trial ends or you cancel, nothing is deleted: you can still sign in, read everything and export it.
Straight answers
What we don't claim
- "HIPAA certified." No government agency certifies software for HIPAA, so we don't say it. We sign a BAA and build in the safeguards the Security Rule asks for.
- A SOC 2 report. We don't have one today. Ask us for what your own vendor review needs.
- That software makes you compliant. Your practice still owns its policies, its own risk analysis, staff training and the devices people sign in on. Cima makes the record-keeping parts easier.
Security questions
Is Cima HIPAA compliant?
Cima is built to meet the HIPAA Security Rule's safeguards, and we sign a Business Associate Agreement with every practice at sign-up. Records are encrypted and hosted in the US on HIPAA-eligible AWS services, every user signs in with two steps, and every chart view is logged in a record that can't be changed.
Will you sign a BAA?
Yes, with every practice, as part of signing up. You can read it before you start at cimaehr.com/legal/baa.
Where is my data stored?
In the United States, in Cima's own AWS account, on HIPAA-eligible services. The disk and the nightly backups are encrypted, and the backups are kept for 6 years.
Is Cima ready for 42 CFR Part 2 records?
Yes. Our BAA includes the qualified service organization terms Part 2 asks for. Releases are checked against the client's signed consent, a revoked consent blocks the release, and substance use programs' releases carry the 42 CFR 2.32 notice.
Can Cima's staff read my clients' charts?
Our support console shows practices, plans and counts, never a client or a note. We use records only to run and support the service, as the BAA allows.
Do reminder texts include health information?
No. Texts and emails never say what a visit is for, and texts go only to clients who agreed to them, within your texting hours.
What happens to my records if I cancel?
Nothing is deleted. You can still sign in, read everything and export it. When the service ends, your records stay available to export for at least 90 days.
Records kept the way you'd keep them yourself.
Free for 30 days, with the BAA from day one.
Get early access