Your health information, in plain English.
When you give a Harness Health surface protected health information (PHI), HIPAA applies. Here's what that actually means.
Where HIPAA applies in our stack
Several Harness Health surfaces process PHI: co-op.care (care plans, caregiver notes, family medical records), SurgeonValue (clinical notes, billing codes, prior-auth letters), ComfortCard (account and profile details, check results a member chooses to save, and the result a family asks to have emailed; receipts and care wishes stay in the on-device family file and are never uploaded), ClinicalSwipe (case reviews and physician attestations), SolvingHealth (the orchestration layer that touches all of the above).
Some surfaces don't process PHI: chanio (general context graph), Sh-Room (mushroom incubator), SweatSciences (consumer fitness), Fill Forward (general MCP connector).
Who's the covered entity
Currently, our HIPAA coverage runs through the licensed physicians who provide attestation — primarily our medical director (DO), licensed across a multi-state footprint, for the LMN, prior-auth, and care-attestation pipelines. Harness Health is positioned as a Business Associate to those physicians' practices; no PHI flows until that agreement is in place.
How your PHI is used
- For treatment — to draft clinical artifacts (LMNs, prior-auth letters) that the responsible physician then attests.
- For payment — to facilitate claims, HSA/FSA reimbursements, and billing under your physician's NPI.
- For operations — to make the service work better. Aggregated, de-identified.
We do not use your PHI for marketing, AI training without consent, or to sell to anyone.
Your rights under HIPAA
- Inspect and copy your PHI on request.
- Request corrections.
- Request a restriction on certain uses or disclosures.
- Receive an accounting of disclosures.
- Request confidential communications.
- File a complaint with us or with the HHS Office for Civil Rights.
Exercise any of these through the contact page.
Physician sign-off: what is and isn't built
The harness is designed so that no agent-written clinical content leaves the system without the responsible physician's signature, and so that no clinical decision is made autonomously. Today that runs in the sandbox with test data. It is not yet enforced in production, and no PHI flows until a Business Associate Agreement is signed.
Breach notification
If we discover a PHI breach, you'll hear from us within the HIPAA-required window. We don't try to minimize. We'll tell you what was accessed, when, by whom (if known), what we're doing about it, and what you should do.
HIPAA contact and general contact: /legal/contact