← Back to home
Legal

HIPAA Notice

Effective Date: May 22, 2026
Last Updated: May 22, 2026

This HIPAA Privacy Notice explains how Rekva LLC handles Protected Health Information (PHI) when used by healthcare providers and other HIPAA-covered entities. If you have questions, contact hipaa@rekva.ai.

1. Understanding Our HIPAA Role

What is HIPAA?

The Health Insurance Portability and Accountability Act (HIPAA) and its implementing regulations (the Privacy Rule and Security Rule) govern the use and disclosure of Protected Health Information. PHI includes any individually identifiable health information — such as a patient's name combined with a reason for a medical visit, diagnosis, appointment details related to a health condition, or other identifiers.

Covered Entities and Business Associates

A Covered Entity is a healthcare provider, health plan, or healthcare clearinghouse that transmits health information electronically. If you are a dental practice, medical clinic, physical therapy office, or similar healthcare provider, you are likely a Covered Entity.

A Business Associate is a vendor or service provider that creates, receives, maintains, or transmits PHI on behalf of a Covered Entity. When Rekva handles calls for a Covered Entity customer where PHI may be involved, Rekva acts as a Business Associate.

2. Business Associate Agreement (BAA)

HIPAA requires a written Business Associate Agreement (BAA) between a Covered Entity and any Business Associate before the Business Associate handles PHI. Rekva offers a BAA to all eligible Covered Entity customers.

How to Request a BAA

If you have not executed a BAA with Rekva, you must not route PHI through the platform. Operating the Service with PHI without an executed BAA is a violation of HIPAA and of our Terms of Service.

3. Subprocessors — BAA Status

Rekva uses the following subprocessors in delivering the Service. When a Covered Entity customer has an executed BAA with Rekva, we ensure that PHI flows only through subprocessors with whom we also maintain BAAs.

Subprocessors WITH Business Associate Agreements

PHI may flow through these subprocessors when a BAA is in place between you and Rekva:

Subprocessors WITHOUT Business Associate Agreements

The following subprocessors do not have BAAs with Rekva. As a result, PHI is never routed to these systems by design:

4. Customer Obligations Under HIPAA

If you are a Covered Entity using Rekva, you are responsible for:

5. Patient Rights Under HIPAA

Patients (end users who call covered entity businesses using Rekva) have the following rights under HIPAA's Privacy Rule. These rights are exercised through the Covered Entity (the healthcare provider), not directly through Rekva as a Business Associate:

Rekva will cooperate with Covered Entity customers in facilitating the exercise of patient rights to the extent required by our BAA and applicable law.

6. Security Practices

Rekva implements administrative, physical, and technical safeguards designed to protect PHI in accordance with HIPAA's Security Rule. Our practices include:

Rekva does not claim HIPAA certification — no such government certification exists. We provide HIPAA-compliant infrastructure and practices and offer BAAs as required by law.

7. Contact for HIPAA Matters

For all HIPAA-related inquiries, including BAA requests, breach reports, and compliance questions:

We aim to respond to all HIPAA inquiries within 5 business days.

8. Changes to This Notice

Rekva may update this HIPAA Privacy Notice to reflect changes in our practices, subprocessors, or applicable law. Material changes will be communicated to affected Covered Entity customers via email. The current version of this Notice is always available at rekva.ai/hipaa.