HIPAA Compliance

When your facility uses CareMAR, your facility is the Covered Entity and CareMAR is your Business Associate, as those terms are defined at 45 CFR § 160.103. That relationship must be documented in a Business Associate Agreement (BAA) before PHI is stored in the platform — HIPAA requires it, and so do we.

We make this easy: we sign a BAA with every customer at no additional cost, and you execute it during signup — you read the full terms and type your name as your signature before your facility stores any PHI, so a signed BAA is on file from day one. Your signed copy, with the version, date and signer recorded, is available to download at any time from Settings. The executed BAA governs our handling of PHI and supersedes any inconsistent language in the Terms of Use or on this page. Questions, redlines, or a request to countersign your facility's own form can go to [email protected].

CareMAR processes PHI only to provide the Service to your facility — never for advertising, and never for sale. Depending on the features you use, that PHI can include:

• Resident demographics, photos, physician and pharmacy contacts, and diagnoses.
• Medication orders, administration records (MAR), and PRN follow-up notes.
• Inbound and outbound faxes, including physician orders and pharmacy communications.
• Uploaded documents and e-signed forms (for example, LIC 622 and LIC 9020).
• Care notes, incident reports, and appointment records.

We apply the minimum necessary standard to our own access: CareMAR personnel touch customer PHI only when needed to operate, support, or troubleshoot the Service, and that access is logged.

• Production access is limited to a small number of trained personnel under least-privilege, role-based access, and is reviewed at least quarterly.
• Everyone with potential PHI access completes HIPAA privacy and security training before first access and at least annually thereafter.
• Access is revoked promptly — the same business day — when personnel change roles or depart.
• We maintain a written incident response plan covering triage, breach risk assessment under 45 CFR § 164.402, customer notification within HIPAA timelines, and documented post-incident review.
• We perform periodic risk analyses of the systems that store or transmit PHI and track remediation of findings, consistent with 45 CFR § 164.308(a)(1).
• Vendors are security-reviewed before they may touch PHI, consistent with our Business Associate Agreement's Subcontractor terms (see Section 6).

• Encryption: PHI is encrypted in transit and at rest, including backups. There is no unencrypted access path to the Service.
• Data residency: all PHI is stored and processed in the United States. No PHI leaves the country.
• Authentication and sessions: facility staff sign in with verified credentials and sessions expire automatically. The Caregiver Portal opens with a facility password administrators can rotate at any time, and each caregiver then signs in with their own 6-digit PIN. PINs are required by default; a home can turn that off, and the administrator's caregiver screen shows which setting is in force.
• Tenant isolation: access is scoped to your facility, enforced on the server for every request — one facility can never read or modify another facility's records.
• Audit logging: PHI access, medication administration events, signature events, login attempts, and administrative actions are logged with timestamp and actor identity (for caregivers, the person who entered their PIN; in a home that has turned PINs off, the name typed on the device), supporting the audit controls requirement at 45 CFR § 164.312(b). Audit records are protected so that access history cannot be silently altered or erased.
• Backups and recovery: facility data is backed up regularly, and records can be restored in the event of data loss or corruption.

Detailed security information is available to customer facilities and prospective customers conducting due diligence — email [email protected].

CareMAR does not operate its own data centers. All production infrastructure runs in United States data centers that maintain independently audited physical security controls. CareMAR personnel have no physical access to those facilities, and no PHI is stored on employee devices or removable media.

We rely on a small number of vetted service providers to support the operation of the Service. Where a provider creates, receives, maintains, or transmits PHI on our behalf, we require it to agree in writing to protections at least as protective as those in our own Business Associate Agreement, consistent with 45 CFR §§ 164.308(b)(2) and 164.502(e)(1)(ii), and every provider is reviewed for security before it may handle PHI. Resident data is never used to train AI models, and our providers are contractually barred from doing so.

Certain optional informational features — such as the Ask CareMAR (Title 22) regulations assistant — are not designed or authorized for processing PHI. Do not enter resident names, dates of birth, or other identifying details into those features; keep questions general.

For a current list of our subcontractors that handle PHI, and each one's Business Associate Agreement status, email [email protected]. Our own Business Associate Agreement — the one you sign at signup — commits us to providing it.

If we discover a breach of unsecured PHI, we will notify the affected facility without unreasonable delay and in no event later than 60 calendar days after discovery, as 45 CFR § 164.410 requires — in practice we aim to notify far sooner. The notification will describe what happened, the categories of PHI involved, the residents affected (to the extent known), the steps we are taking to contain and remediate, the steps your facility should consider, and a contact for follow-up. We will cooperate with your facility's own investigation and provide the information you need for your notification obligations.

Your facility, as the Covered Entity, remains responsible for notifying affected individuals, the U.S. Department of Health and Human Services (HHS), and — where required — the media under the Breach Notification Rule (45 CFR §§ 164.404–408).

Your facility owns its records. While your subscription is active you can export resident records, MARs, and documents at any time from Account → Export data, as a full ZIP archive.

When a subscription ends, we keep your data for 14 days, then delete it. During that window you can still sign in, view and export everything (records are read-only), and resubscribing restores the facility exactly as it was. We email the administrator on file during that window — starting the day the subscription ends — with a direct export link and the scheduled deletion date. At the end of the 14 days the facility and all of its resident records are permanently destroyed.

We don't keep it longer than that on purpose. Holding protected health information for a facility that is no longer a customer creates risk for that facility's residents and for us, so we return the records and delete our copy rather than warehousing PHI indefinitely. Deletion is performed consistent with NIST SP 800-88 media-sanitization guidance. Where deletion is temporarily infeasible — for example, PHI in encrypted backups awaiting scheduled rotation — the BAA's protections continue to apply until the data is destroyed.

California RCFE record-retention obligations under Title 22 remain your facility's responsibility. Title 22 generally requires retaining certain resident records for at least three years after discharge; our 14-day window is a hand-back period, not a records-retention service. Export what you are required to keep before closing your account.

HIPAA compliance is shared. CareMAR provides the secure platform, contractual commitments, and access controls; your facility is responsible for using them correctly. In particular, your facility must:

• Execute a BAA with CareMAR before storing PHI in the platform.
• Limit administrator accounts to staff authorized to access resident records, and deactivate accounts promptly when staff depart.
• Rotate the Caregiver Portal password whenever care staff change, and revoke a departing caregiver's PIN.
• Use strong, unique passwords and enable available second-factor options.
• Verify recipients before sending faxes or signature requests.
• Report suspected account compromise or misdirected PHI to us immediately.
• Maintain your own HIPAA policies, staff training, and Notice of Privacy Practices as a Covered Entity.

If you believe you have found a vulnerability or witnessed an incident involving CareMAR, email [email protected] with "Security report" in the subject line. Security reports are acknowledged within one business day.

Please never test against live customer data — use a free trial account for any proof-of-concept work.

We update this page as our practices evolve; the "Last Updated" date above reflects the most recent revision. Material changes affecting customers' BAA obligations are also announced by email to facility administrators.