> ## Documentation Index
> Fetch the complete documentation index at: https://docs.imaracare.com/llms.txt
> Use this file to discover all available pages before exploring further.

# HIPAA compliance

> How ImaraCare supports HIPAA obligations — DPA, NPP, breach notifications, data retention, MFA, and audit logs.

ImaraCare is purpose-built for group homes that handle protected health information (PHI). This page maps ImaraCare features to the HIPAA Security and Privacy Rule provisions they support.

<Info>
  ImaraCare is a tool — your facility remains the **covered entity** responsible for HIPAA compliance. This page explains how the platform supports your obligations; it is not legal advice.
</Info>

## Data Processing Agreement (DPA)

**HIPAA § 164.308(b) — Business Associate Agreements**

ImaraCare acts as a Business Associate. You must accept the current DPA in **Settings → Data** before using the platform for PHI.

* DPA versioning is tracked with acceptance date and user
* A new DPA version triggers an in-app prompt for re-acceptance
* [Full DPA text](https://imaracare.com/dpa) available at imaracare.com/dpa

See [Notice of Privacy Practices](/administration/notice-of-privacy-practices) for the NPP companion.

## Multi-factor authentication

**HIPAA § 164.312(d) — Person or Entity Authentication**

Managers and Administrators must complete email one-time password (OTP) verification each workday. The platform enforces this automatically on sign-in.

See [Two-factor authentication](/account/two-factor-authentication) for setup and troubleshooting.

## Audit controls and activity logs

**HIPAA § 164.312(b) — Audit Controls**

ImaraCare logs creates, updates, deletes, logins, and data access events facility-wide. Administrators can search and export logs from [Activity logs](/administration/activity-logs).

Resident-level access history is accessible per resident from the **Disclosures** tab in the resident profile. See [Information Access Log](/resident-care/accounting-of-disclosures).

## Breach notification tracking

**HIPAA § 164.400–414 — Breach Notification Rule**

The **Breach Notifications** tab in Settings tracks potential PHI breaches, calculates 60-day HHS notification deadlines, and records risk assessment outcomes.

See [Breach notifications](/administration/breach-incidents).

## Notice of Privacy Practices

**HIPAA § 164.520 — NPP**

Track your facility's NPP version acknowledgment from **Settings → Data**. ImaraCare records the version acknowledged and the timestamp.

See [Notice of Privacy Practices](/administration/notice-of-privacy-practices).

## Data retention

**HIPAA § 164.530(j) — Retention of Documentation**

ImaraCare soft-deletes records and permanently purges them after your configured retention period. The default is **7 years** (2,555 days); the minimum is 1 year.

Configure the period in **Settings → Data → Data Retention Policy**.

## Session controls

**HIPAA § 164.312(a)(2)(iii) — Automatic Logoff**

Sessions expire after **45 minutes of inactivity**. Administrators can also terminate any active session from **Settings → Sessions**.

## Security alerts

ImaraCare monitors for repeated authentication failures and cross-facility access anomalies. Alerts appear in **Settings → Data → Security Alerts** for Administrator review and acknowledgment.

## Encryption

* Data in transit: TLS 1.3
* Data at rest: AES-256 via Supabase (US East, N. Virginia)
* File storage: encrypted at rest via Supabase Storage

## Summary checklist

| Obligation                   | Where to act in ImaraCare                            |
| ---------------------------- | ---------------------------------------------------- |
| Business Associate Agreement | Settings → Data → DPA                                |
| MFA for staff                | Enforced automatically for Manager and Administrator |
| Audit log review             | Administration → Activity Logs                       |
| NPP acknowledgment           | Settings → Data → Notice of Privacy Practices        |
| Breach incident tracking     | Settings → Breach Notifications                      |
| Data retention period        | Settings → Data → Data Retention Policy              |
| Session termination          | Settings → Sessions                                  |