HIPAA Privacy Rule

45 CFR Part 164, Subpart E

The law asks

Protected health information is used and disclosed only for permitted purposes, limited to the minimum necessary, and patients can access, amend and get an accounting of their records.

Tunzly does

Uses an agency’s PHI only to provide the service under its BAA — never sold, never used for marketing, never used to train AI models.
Every staff member sees only their own agency’s records, narrowed further by role and permission.
When a patient asks your agency for their records, an amendment or an accounting of disclosures, we give you what you need within 15 days so you meet your 30-day deadline.
Email carries links, never clinical content. Reports with PHI go by an expiring link, and every download is logged.

Your agency does

Publish your notice of privacy practices, collect authorizations where required, and answer patient requests. You decide who on your team gets which role.

HIPAA Security Rule — administrative safeguards

45 CFR §164.308

The law asks

A written risk analysis, a named security official, workforce access and training, incident procedures, a contingency plan, and business associate agreements with anyone handling ePHI.

Tunzly does

A written risk analysis of the production system, reviewed at least yearly and whenever something affecting ePHI changes.
A designated Security Officer accountable for policies, incidents and vendor agreements.
Production access only for people who need it, removed the day the need ends; HIPAA training before access and every year.
Automated, encrypted database backups with deletion protection, and a restore rehearsed at least yearly.
Executed BAAs with every subprocessor that can touch ePHI (see subprocessors below).

Your agency does

Run your own security risk analysis covering how your staff use Tunzly, train your workforce, and keep your own sanctions and incident policies.

HIPAA Security Rule — physical safeguards

45 CFR §164.310

The law asks

Control physical access to systems and devices that hold ePHI, and how media is disposed of.

Tunzly does

No server rooms of our own: ePHI lives in AWS data centers covered by AWS’s BAA and its SOC 2 and ISO 27001 certifications.
Admin devices use full-disk encryption and a 5-minute screen lock, and never store real patient data — no exports, dumps or screenshots.
Any device that held production credentials is wiped before reuse or disposal.

Your agency does

Secure the office computers and phones your staff and caregivers use: screen locks, updates, and no shared logins.

HIPAA Security Rule — technical safeguards

45 CFR §164.312

The law asks

Unique user IDs, automatic logoff, encryption, audit controls, integrity protection and secure transmission.

Tunzly does

Every user has their own account. Two-step sign-in is mandatory for staff — the service refuses to start in production with it switched off.
Passwords of 12–128 characters, checked against known breaches. Five failed sign-ins lock the account.
Access tokens last 15 minutes and every session ends after 12 hours. Reusing a stolen refresh token signs out every session.
Encrypted at rest and in transit (TLS). The most sensitive fields are encrypted again with a key that belongs to your agency alone (AES-256-GCM, AWS KMS).
Agencies are separated by the database itself — row-level security on every tenant table — not only by application code.
Sign-ins, permission changes, emergency access and PHI downloads are logged with who, when and from where. Logs carry identifiers, never clinical values.

Your agency does

Set roles and permissions to match each job, deactivate people the day they leave, and review your audit log.

HIPAA Breach Notification Rule

45 CFR §§164.400–414

The law asks

A business associate tells the covered entity about a breach of unsecured PHI without unreasonable delay and within 60 days; the covered entity notifies patients, HHS and, for large breaches, the media.

Tunzly does

A written incident response plan: contain, assess, notify, review.
We notify your agency without unreasonable delay — our target is 5 business days from discovery, and never later than 60 days.
The notice names who was affected as far as known, what data, when, what we are doing, and what you should do.

Your agency does

Notify affected patients, HHS, and the media where 500 or more people in one state are affected. We give you what you need to meet those deadlines.

HITECH Act and the Omnibus Rule

42 U.S.C. §17931 · 45 CFR §164.502(e), §164.504(e)

The law asks

Business associates are directly liable for HIPAA compliance, and must hold their own subcontractors to the same terms in writing.

Tunzly does

Signs a business associate agreement with every agency, on every plan, before any client data goes in.
Holds every subprocessor that can touch ePHI to a BAA. An integration stays off for an agency until that vendor’s agreement is in place.
Makes its practices and records about PHI available to HHS on request.
When you leave, returns or destroys your PHI as the BAA says: data deleted, your encryption keys scheduled for deletion.

Your agency does

Sign the BAA at signup and keep it with your compliance records.

21st Century Cures Act — Electronic Visit Verification

Social Security Act §1903(l)

The law asks

Medicaid personal care and home health visits record six data points electronically: service type, who received it, date, location, who provided it, and start and end time.

Tunzly does

Caregivers clock in and out on their phone; GPS location and time are captured at the door against a geofence your agency sets.
Visits that don’t line up land in an exception queue, with a reason recorded on every fix.
Compliance and exception reports come from the same records, exportable for an auditor.
Submission to state aggregators is in progress, not live. We will tell you where your state stands before you switch.

Your agency does

Telephone Consumer Protection Act

47 U.S.C. §227

The law asks

Consent before automated calls or text messages to a person’s phone.

Tunzly does

Texting consent is recorded per person, and the dialer will not text someone without it.
A do-not-contact list your agency manages is checked before calls and texts go out.

Your agency does

Collect consent when you take on a client, family member or caregiver, and honor opt-outs.

ESIGN Act and UETA

15 U.S.C. §7001 · Uniform Electronic Transactions Act

The law asks

An electronic signature is binding when the signer intends to sign, consents to doing business electronically, and the record is kept accurately.

Tunzly does

The signer’s identity is verified before the signature is taken, and every step is audit-stamped.
Each final signed document is locked for six years with S3 Object Lock in compliance mode — no one, including us, can delete or shorten it.

Your agency does

Choose which documents you send for e-signature and keep longer where your state requires it.

Where Canadian data lives

Data residency

The law asks

Several provinces restrict or attach conditions to personal health information leaving the province or the country.

Tunzly does

Canadian agencies are served from AWS in Montreal (ca-central-1). Records, documents and backups stay in Canada.
AI features for Canadian agencies run in a Canadian region too. If a compliant region isn’t available the request fails — it never falls back to the US.

Your agency does

Tell us your province at signup so your account is placed in the right region.

PIPEDA

Personal Information Protection and Electronic Documents Act

The law asks

Accountability, meaningful consent, safeguards proportionate to sensitivity, individual access, and reporting breaches that create a real risk of significant harm.

Tunzly does

Processes personal information only on your agency’s behalf, under our agreement with you.
Consent is recorded per person with its type and date, and checked before the actions that need it.
Data-subject exports with their own audit trail, so you can answer access requests.
A register of confidentiality incidents, and prompt notice to your agency so you can assess and report.

Your agency does

Name a privacy officer, answer access requests, and report qualifying breaches to the Office of the Privacy Commissioner and to affected people.

Ontario PHIPA

Personal Health Information Protection Act, 2004

The law asks

Health information custodians get knowledgeable consent, honor a patient’s “lockbox” instructions, and keep a record of who viewed and changed health records.

Tunzly does

Acts as your agent and electronic service provider; you remain the custodian.
Express, knowledgeable consent is captured before health information is collected or shared.
Lockbox consent directives are enforced and fail closed. Overriding one needs a stated reason, is time-limited, and is audited.
Every access to a record is logged and can be reported.

Your agency does

Explain your information practices to clients, record their consent and lockbox instructions, and respond to access requests.

Quebec Law 25

Act respecting the protection of personal information in the private sector, as amended

The law asks

A person in charge of personal information, privacy impact assessments before information leaves Quebec, express consent for sensitive information, an incident register, and data portability.

Tunzly does

Quebec data stays in Quebec: Montreal hosting means it doesn’t leave the province, so no cross-border assessment is triggered.
Privacy impact assessments are recorded in the product, and the actions that need one are blocked until it exists.
Express consent is captured before sensitive information is used.
Confidentiality incidents are kept in a register you can show the Commission d’accès à l’information.
Data-subject exports, each with its own audit trail, for access and portability requests.

Your agency does

Designate your person in charge, publish your governance policies, and report serious incidents to the Commission and to affected people.

Quebec Charter of the French language (Bill 96)

Charter of the French language, as amended in 2022

The law asks

Software, documents and communications are available in French for people in Quebec.

Tunzly does

Every screen, email, notification, invoice and generated PDF works in French or English, chosen per person.
French is reviewed by a native Canadian French speaker. Legal terms state which version governs.

Your agency does

Set each staff member’s and client’s language preference.

Canada’s Anti-Spam Legislation

S.C. 2010, c. 23

The law asks

Consent, identification and a working unsubscribe for commercial electronic messages.

Tunzly does

Consent for commercial electronic messages is recorded per person and checked before they are sent.

Your agency does

Collect consent before sending promotional email or texts.

Access controls in the product

The checks Tunzly applies to who can see or change health information, and when.

Emergency access, on the record: When a clinician needs a chart they can’t normally open, they give a reason and confirm MFA. Your security officer and admins are alerted at once. Access covers one client, read-only, ends after four hours, and stops as soon as their role changes.
Patient restrictions enforced by the database: When a client asks to keep certain staff, roles or records out, the database withholds those records everywhere — screens, reports, calendar feeds and AI — not just the screens.
No one grants more than they hold: An admin can’t hand out a permission they don’t have, or make themselves Super Admin. Every role change is audited.
A fresh MFA code for sensitive changes: Changing direct-deposit details, signing and emergency access ask for MFA again on that session, not just at sign-in.
Stolen sessions shut down: Sign-ins expire after 30 idle minutes and 12 hours at most. If a stolen session is replayed, every session for that person is signed out.
Suspended means locked: When an agency’s account is suspended or cancelled, its encryption key is switched off, so its records can’t be read, and switched back on before it’s reactivated.
Nothing private on lock screens: Push notifications say only that something needs attention — never a client’s name or the reason for emergency access.

Subprocessors

Every outside service that runs part of Tunzly. Each one that can touch health information has signed a business associate agreement, or the Canadian equivalent, with us.

Service	What it does	Handles health information
Amazon Web Services	Hosting, database, storage, encryption keys, email, AI (Bedrock)	Yes
Twilio	Calls and text messages	Yes
Aircall	Call system integration and recordings	Yes
Availity	Insurance claims, eligibility and remittances	Yes
Stripe	Card and bank payments	No — payment data only
OpenAI	AI tasks that carry no health information	No — blocked by a scanner and checked on every build

Our business associate agreement

Every plan includes a BAA, and it’s part of signing up — you agree to it before any client data enters Tunzly. It commits us to the permitted uses above, the safeguards in this page, breach notice to you, and returning or destroying your data when you leave.

Ask for our documents

Your compliance reviewer can request our security risk analysis summary, security and privacy policies, incident response plan and subprocessor agreements. Email hello@tunzly.com — and report a suspected security issue the same way.

Last reviewed October 23, 2026. This page describes how Tunzly works; it isn’t legal advice. Your agency’s own obligations depend on your state or province — confirm them with your counsel.