# HIPAA

How PDF Blocks supports protected health information: a signed Bonterms BAA, a dedicated US HIPAA endpoint, and a stateless pipeline that leaves no PHI at rest.

PDF Blocks can be used for workflows that involve protected health information
(PHI) under two conditions: you have a Business Associate Agreement (BAA) in
place with us, and you send those requests to our US HIPAA endpoint. This page
explains both, and what each side is responsible for.

Without a signed BAA, our [Terms & Conditions](/docs/trust/terms) prohibit
sending PHI to the API. The BAA is the written agreement that permits it.

## The BAA we sign

We use the **[Bonterms Standard Agreement Business Associate Agreement (BAA),
Version 1.0](https://bonterms.com/standard/business-associate-agreement-v1)**, a
published industry-standard form. You sign a short Cover Page that incorporates
the standard form into your agreement with us.

If your organization requires its own BAA instead of the standard form, we will
review, negotiate, and sign yours for a flat one-time fee of **$1,000**.

Both options are available on the Business plan. Email
[security@pdfblocks.com](mailto:security@pdfblocks.com) to start: we will send
the Cover Page for signature, or your BAA to our counsel.

## The US HIPAA endpoint

Once your BAA is signed, send every PHI request to:

```
https://hipaa.api.pdfblocks.com
```

It is a United States endpoint operated for PHI workflows. Like every region it
is stateless and runs the full action catalog, so no feature is given up by
using it. See [Regions & data
residency](/docs/api/regions-and-data-residency) for how regional endpoints
work.

<Warning>
  The BAA covers requests sent to the HIPAA endpoint. Requests sent to the
  global endpoint or to another regional endpoint are outside it, so point your
  integration at `hipaa.api.pdfblocks.com` before you send the first document.
</Warning>

## There is no PHI at rest

The API processes each document in memory and returns the result in the same
response. Nothing is written to a database or durable storage, so a document
containing PHI exists on our side only for the duration of the request that
carried it, and the response you receive is the only copy.

This makes several BAA obligations structural rather than procedural. The
return-or-destroy obligation at termination is already satisfied: there is no
retained PHI to return or destroy, and no backup or archive to expunge. There is
also no endpoint that lists, downloads, or replays documents you processed
earlier, so a stolen API key cannot reach PHI. It can only spend quota, and keys
can be revoked instantly.

For each request we record metadata only: an API-key digest, the action
requested, input and output byte counts, the response status, and a timestamp.
Document contents are never logged.

## No AI touches PHI

Every action is a deterministic transformation implemented in code. No large
language model reads your documents, the pipeline calls no third-party AI
service, and **no document content is ever used to train or fine-tune a model**.
This holds on every endpoint, not just the HIPAA one. See [AI and machine
learning](/docs/trust/security#ai-and-machine-learning) for the full statement.

## How our controls map to the Security Rule

| Safeguard | How the PDF Blocks API addresses it |
| --- | --- |
| **Technical** | TLS 1.3 / 1.2 in transit; API keys stored only as SHA-256 digests and revocable at any time; least-privilege access; processing in isolated private networks with no outbound internet access; metadata-only logging that never captures document contents. |
| **Physical** | Compute runs in AWS and Microsoft Azure data centers, which maintain SOC 2, ISO 27001, and PCI DSS attestations for their facilities. Instance disks are encrypted and destroyed when an instance is retired. |
| **Administrative** | Documented information security, access control, incident response, and business continuity policies; confidentiality obligations on staff and subprocessors; documented incident response with defined severities and notification steps; automated vulnerability scanning and defined remediation timelines. |
| **Breach notification** | We notify you of confirmed or suspected incidents affecting your data without undue delay, on the terms set out in the BAA and our [Data Processing Addendum](/docs/trust/dpa). |

The [Security](/docs/trust/security) page describes each of these controls in
detail, and our internal security policies are available on the Business plan
under a mutual NDA.

## What you are responsible for

HIPAA compliance is shared. On your side:

- **Route PHI to the HIPAA endpoint.** Nothing else is covered by the BAA.
- **Keep PHI out of everything except the document.** Account fields, API key
  names, and support tickets live in our account systems, which never receive
  your documents and are not covered by the BAA. Do not put PHI in them.
- **Apply the minimum necessary standard.** Send only the documents and pages
  the operation requires.
- **Revoke any API key you believe is exposed.** A key meters usage and cannot
  reach documents, so an exposed key spends quota rather than disclosing PHI.
  There is no rotation schedule to keep.
- **Secure the result.** Once the response leaves us, the copy is yours to store
  and protect under your own program.

## Questions

Email [security@pdfblocks.com](mailto:security@pdfblocks.com) for the BAA Cover
Page, a completed security questionnaire, or any control not covered here.