# HIPAA How PDF Blocks supports protected health information: a signed Bonterms BAA, a dedicated US HIPAA endpoint, and a stateless pipeline that leaves no PHI at rest. PDF Blocks can be used for workflows that involve protected health information (PHI) under two conditions: you have a Business Associate Agreement (BAA) in place with us, and you send those requests to our US HIPAA endpoint. This page explains both, and what each side is responsible for. Without a signed BAA, our [Terms & Conditions](/docs/trust/terms) prohibit sending PHI to the API. The BAA is the written agreement that permits it. ## The BAA we sign We use the **[Bonterms Standard Agreement Business Associate Agreement (BAA), Version 1.0](https://bonterms.com/standard/business-associate-agreement-v1)**, a published industry-standard form. You sign a short Cover Page that incorporates the standard form into your agreement with us. If your organization requires its own BAA instead of the standard form, we will review, negotiate, and sign yours for a flat one-time fee of **$1,000**. Both options are available on the Business plan. Email [security@pdfblocks.com](mailto:security@pdfblocks.com) to start: we will send the Cover Page for signature, or your BAA to our counsel. ## The US HIPAA endpoint Once your BAA is signed, send every PHI request to: ``` https://hipaa.api.pdfblocks.com ``` It is a United States endpoint operated for PHI workflows. Like every region it is stateless and runs the full action catalog, so no feature is given up by using it. See [Regions & data residency](/docs/api/regions-and-data-residency) for how regional endpoints work. <Warning> The BAA covers requests sent to the HIPAA endpoint. Requests sent to the global endpoint or to another regional endpoint are outside it, so point your integration at `hipaa.api.pdfblocks.com` before you send the first document. </Warning> ## There is no PHI at rest The API processes each document in memory and returns the result in the same response. Nothing is written to a database or durable storage, so a document containing PHI exists on our side only for the duration of the request that carried it, and the response you receive is the only copy. This makes several BAA obligations structural rather than procedural. The return-or-destroy obligation at termination is already satisfied: there is no retained PHI to return or destroy, and no backup or archive to expunge. There is also no endpoint that lists, downloads, or replays documents you processed earlier, so a stolen API key cannot reach PHI. It can only spend quota, and keys can be revoked instantly. For each request we record metadata only: an API-key digest, the action requested, input and output byte counts, the response status, and a timestamp. Document contents are never logged. ## No AI touches PHI Every action is a deterministic transformation implemented in code. No large language model reads your documents, the pipeline calls no third-party AI service, and **no document content is ever used to train or fine-tune a model**. This holds on every endpoint, not just the HIPAA one. See [AI and machine learning](/docs/trust/security#ai-and-machine-learning) for the full statement. ## How our controls map to the Security Rule | Safeguard | How the PDF Blocks API addresses it | | --- | --- | | **Technical** | TLS 1.3 / 1.2 in transit; API keys stored only as SHA-256 digests and revocable at any time; least-privilege access; processing in isolated private networks with no outbound internet access; metadata-only logging that never captures document contents. | | **Physical** | Compute runs in AWS and Microsoft Azure data centers, which maintain SOC 2, ISO 27001, and PCI DSS attestations for their facilities. Instance disks are encrypted and destroyed when an instance is retired. | | **Administrative** | Documented information security, access control, incident response, and business continuity policies; confidentiality obligations on staff and subprocessors; documented incident response with defined severities and notification steps; automated vulnerability scanning and defined remediation timelines. | | **Breach notification** | We notify you of confirmed or suspected incidents affecting your data without undue delay, on the terms set out in the BAA and our [Data Processing Addendum](/docs/trust/dpa). | The [Security](/docs/trust/security) page describes each of these controls in detail, and our internal security policies are available on the Business plan under a mutual NDA. ## What you are responsible for HIPAA compliance is shared. On your side: - **Route PHI to the HIPAA endpoint.** Nothing else is covered by the BAA. - **Keep PHI out of everything except the document.** Account fields, API key names, and support tickets live in our account systems, which never receive your documents and are not covered by the BAA. Do not put PHI in them. - **Apply the minimum necessary standard.** Send only the documents and pages the operation requires. - **Revoke any API key you believe is exposed.** A key meters usage and cannot reach documents, so an exposed key spends quota rather than disclosing PHI. There is no rotation schedule to keep. - **Secure the result.** Once the response leaves us, the copy is yours to store and protect under your own program. ## Questions Email [security@pdfblocks.com](mailto:security@pdfblocks.com) for the BAA Cover Page, a completed security questionnaire, or any control not covered here.