HIPAA Compliance
Use Google Calendar. Keep client details off our servers. Sleep Better.
The Bottom Line
We can't leak what we don't hold. Your clients' protected health information never touches our servers.
HIPAA compliance belongs to your practice, and HHS doesn't certify software for it. NoAdmin is built to support it, and we sign a Business Associate Agreement.
How NoAdmin Supports Your HIPAA Compliance
Zero-PHI Servers
Your clients' full names, emails, and addresses never touch our servers. We see only privacy-friendly aliases like "JAN-001" that significantly reduces identifiability.
Real Example: When you sync "Session with Jane" from Google Calendar, we map it to "JAN-001" on your device. Our servers never see that JAN-001 is actually Jane Elizabeth Doe, DOB 3/15/1985, jane.doe@email.com. That information stays encrypted on your device only.
Encrypted Local Storage
Your clients' real names are encrypted on your device using military-grade AES-256 encryption. The encryption key is derived from your account and never stored anywhere.
- AES-256-GCM encryption (same as your bank)
- PBKDF2 key derivation with 100,000 iterations
- Non-extractable encryption keys (prevents XSS theft)
Hashed Payment Matching
When matching bank deposits to clients, we use one-way cryptographic hashes. We can match payments without ever seeing or storing the payer's name.
How it works: Your client "Jane Doe" pays via Venmo. We receive a SHA-256 hash of "JANE DOE" like "a24c084f...", but never the actual name. The hash matches, the payment is applied, and we still don't know who paid.
Smart Calendar Identity
Your calendar events might say "Session with Gladys", but our servers only know her as "GLA-431". We securely map these names on your device so you don't have to manually select clients every time.
Stored in Vault: The link between "Gladys" and "GLA-431" is stored in your encrypted local vault. It never leaves your device, keeping your calendar workflow smooth and private.
Local-First PDFs
When you download an invoice or superbill for insurance submission, your client's full name is decrypted from your device and inserted client-side. The full name never touches our servers.
- PDFs generated entirely in your browser
- PHI decrypted and inserted only at print/download time
- No server-side rendering means no server-side PHI exposure
BAA Included
Every account includes a signed Business Associate Agreement — the agreement HIPAA requires between a covered entity and a service provider that works on its behalf.
Why Zero-Footprint Matters
| Concern | Traditional Approach | NoAdmin Zero-Footprint |
|---|---|---|
| Data Breach | All PHI exposed if breached | No PHI to breach |
| HIPAA Violations | Civil penalties for each violation | Fewer details held, less to protect |
| Convenience | Can't use standard calendar apps | Use Google Calendar freely |
| Trust | Hope they don't get hacked | Names encrypted on your device |
Frequently Asked Questions
What happens if I lose access to my device?
Your PHI data can be exported as a backup file and re-imported on a new device. The export file is unencrypted, so keep it secure (password-protected folder, encrypted USB drive, etc.).
Can I access my data from multiple devices?
Yes. Your encrypted PHI is stored in your browser's localStorage on each device you use. You can export from one device and import to another or sync between devices via peer-to-peer encryption.
What if someone gets access to my computer?
The encryption key is derived from your NoAdmin account credentials. An attacker would need both your device AND your account credentials to decrypt the PHI. Always use a strong password and enable 2FA on your NoAdmin account.
Is this really more secure than "encrypted at rest"?
Yes. "Encrypted at rest" means data is encrypted on the server's hard drive, but the server has the decryption key. If the server is compromised, so is your data. With Zero-Footprint, the decryption key never leaves your device, so even if our servers were compromised, your clients' names remain safe.
Do I still need a BAA with Google for using Google Calendar?
Yes. While NoAdmin itself maintains Zero-Footprint architecture, you may still be storing calendar entries like "Session with Jane" in Google Calendar. You should have a BAA with Google Workspace (available for Google Workspace accounts).
Private & paperless without credit card fees
Syncs with Google Calendar. Reconciles Venmo/Zelle. Zero-Footprint by design.