HIPAA position · updated 2026-09-23
HIPAA position
Your files never reach us, so we are not a business associate. We offer no agreement because there is nothing for one to cover.
What we hold
Nothing. Every file is read in your browser and no part of it is sent to us. On your device, the first operation on every table drops the columns whose headers we recognise as a person’s identifier: name, email, phone, date of birth, dates about the person, chart number, address, government id, account, notes, measured against the eighteen identifier classes in the HIPAA de-identification standard, 45 CFR 164.514(b)(2). The rules on the dashboard list what was removed from each table. What remains is the business row: the date, the provider, the service, the quantity and the money.
Why no business associate agreement
A business associate is a vendor that creates, receives, maintains or transmits protected health information on a covered entity’s behalf (45 CFR 160.103). The Department of Health and Human Services says that providing software to a covered entity does not make the vendor a business associate if the vendor has no access to the information. Your files are read by Ottersheet inside your browser; we have no access to them, in the same way a spreadsheet program on your computer has no access. That is why we offer no business associate agreement: it would claim a role we do not have. This is true of every file type Ottersheet reads.
What we do not claim
We do not claim the rows that remain are de-identified under HIPAA’s Safe Harbor standard. That standard also removes every date except the year and every transaction number, and margin by month needs the month, and merging two exports needs the invoice number. Those stay, in your browser, on your device.
Whether HIPAA applies to you
Whether HIPAA applies to your practice is your determination, not ours. A practice that never bills a health plan electronically is often not a covered entity; state laws such as California’s Confidentiality of Medical Information Act, Texas HB 300 and Washington’s My Health My Data Act protect your records whether or not HIPAA does, and Ottersheet’s handling is the same either way. This page describes what Ottersheet does; it is not legal advice.
Unrecognised columns
If your export carries an identifier in a column we do not recognise, tell us and we will add it to the drop list; until then, remove that column before you give us the file. Free-text columns such as notes are dropped by header for the same reason: a note often contains a name.
Contact
Compliance questions go to support@ottersheet.com.