ImaraCare is a tool — your facility remains the covered entity responsible for HIPAA compliance. This page explains how the platform supports your obligations; it is not legal advice.
Data Processing Agreement (DPA)
HIPAA § 164.308(b) — Business Associate Agreements ImaraCare acts as a Business Associate. You must accept the current DPA in Settings → Data before using the platform for PHI.- DPA versioning is tracked with acceptance date and user
- A new DPA version triggers an in-app prompt for re-acceptance
- Full DPA text available at imaracare.com/dpa
Multi-factor authentication
HIPAA § 164.312(d) — Person or Entity Authentication Managers and Administrators must complete email one-time password (OTP) verification each workday. The platform enforces this automatically on sign-in. See Two-factor authentication for setup and troubleshooting.Audit controls and activity logs
HIPAA § 164.312(b) — Audit Controls ImaraCare logs creates, updates, deletes, logins, and data access events facility-wide. Administrators can search and export logs from Activity logs. Resident-level access history is accessible per resident from the Disclosures tab in the resident profile. See Information Access Log.Breach notification tracking
HIPAA § 164.400–414 — Breach Notification Rule The Breach Notifications tab in Settings tracks potential PHI breaches, calculates 60-day HHS notification deadlines, and records risk assessment outcomes. See Breach notifications.Notice of Privacy Practices
HIPAA § 164.520 — NPP Track your facility’s NPP version acknowledgment from Settings → Data. ImaraCare records the version acknowledged and the timestamp. See Notice of Privacy Practices.Data retention
HIPAA § 164.530(j) — Retention of Documentation ImaraCare soft-deletes records and permanently purges them after your configured retention period. The default is 7 years (2,555 days); the minimum is 1 year. Configure the period in Settings → Data → Data Retention Policy.Session controls
HIPAA § 164.312(a)(2)(iii) — Automatic Logoff Sessions expire after 45 minutes of inactivity. Administrators can also terminate any active session from Settings → Sessions.Security alerts
ImaraCare monitors for repeated authentication failures and cross-facility access anomalies. Alerts appear in Settings → Data → Security Alerts for Administrator review and acknowledgment.Encryption
- Data in transit: TLS 1.3
- Data at rest: AES-256 via Supabase (US East, N. Virginia)
- File storage: encrypted at rest via Supabase Storage