Effective Date: June 19, 2026 · Last Updated: June 19, 2026
Cowboy Systems is designed from the ground up for HIPAA compliance. As a Business Associate to healthcare covered entities, we maintain the administrative, physical, and technical safeguards required by the HIPAA Security Rule to protect Protected Health Information (PHI).
1. Our Role Under HIPAA
Cowboy Systems operates as a Business Associate as defined under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the Health Information Technology for Economic and Clinical Health (HITECH) Act.
As a Business Associate, we:
Create, receive, maintain, and transmit PHI on behalf of Covered Entities (your practice)
Process PHI only as permitted by the signed Business Associate Agreement (BAA)
Do not use PHI for any purpose beyond providing the contracted services
Maintain safeguards equivalent to those required of Covered Entities under the Security Rule
Report breaches of unsecured PHI in accordance with the Breach Notification Rule
Data hosted in enterprise-grade, HIPAA-eligible data centres with physical access controls, CCTV, and redundant power.
Technical Safeguards
AES-256 encryption at rest, TLS 1.3 in transit, MFA, audit logs, automatic session timeouts.
3. Technical Security Controls
3.1 Encryption
At rest: All PHI is encrypted using AES-256. Encryption keys are managed via a dedicated key management service with automatic rotation.
In transit: All data transmitted between clients and our servers uses TLS 1.3 with strong cipher suites. Unencrypted connections are rejected.
Backups: All backup data is encrypted using the same standards as primary storage.
3.2 Access Controls
Role-based access control (RBAC) limiting data access to only what is required for each user's role
Mandatory multi-factor authentication (MFA) for all administrative accounts
Automatic session timeout after periods of inactivity
Unique user credentials — no shared logins permitted
Emergency access procedures with full audit trail
3.3 Audit Controls
Comprehensive audit logging of all PHI access, modifications, and exports
Logs are tamper-evident and retained for a minimum of 6 years
Automated alerts for anomalous access patterns
Regular review of access logs by our security team
3.4 Availability and Integrity
99.9% platform uptime target with geo-redundant infrastructure across multiple availability zones
Automated daily backups with point-in-time recovery capability
Data integrity checks performed continuously to detect unauthorized alteration
Disaster recovery plan tested annually with defined Recovery Time Objectives (RTO)
4. Workforce and Training
All Cowboy Systems employees and contractors who may access PHI are required to:
Complete HIPAA privacy and security training before accessing any systems
Undergo annual refresher training
Sign confidentiality agreements as a condition of employment
Follow our documented security policies and incident response procedures
Access to PHI by Cowboy Systems staff is restricted to only those individuals whose roles require it for platform support and operations.
5. Subcontractors and Sub-Business Associates
Where we engage subcontractors who may access PHI (such as cloud hosting providers), we enter into Business Associate Agreements with those subcontractors as required by HIPAA. We perform due diligence on the security practices of all subcontractors before engagement and monitor compliance on an ongoing basis.
6. Breach Notification
In the event of a breach of unsecured PHI, Cowboy Systems will:
Notify the affected Covered Entity without unreasonable delay and no later than 60 days of discovery
Provide details of the breach including: the nature of the PHI involved, who accessed it, what was done to mitigate harm, and steps taken to prevent recurrence
Cooperate fully with the Covered Entity's breach response obligations under 45 CFR § 164.400–414
Cowboy Systems conducts periodic risk assessments in accordance with 45 CFR § 164.308(a)(1) to identify, assess, and mitigate risks to the confidentiality, integrity, and availability of PHI. Findings are documented and tracked to remediation.
8. Business Associate Agreement
A signed Business Associate Agreement (BAA) is required before any PHI may be stored on the Cowboy Systems platform. BAAs are included as standard with Growth and Enterprise plans. Starter plan customers must execute a BAA before using the platform to store PHI.
