# Security and BAA

> How the BloomText API protects patient data, and the BAA required for API access.

Source: https://www.bloomtext.com/developers/api/security-and-baa/

BloomText is HIPAA-compliant, and API access requires a signed Business Associate Agreement. [Request API access](https://calendly.com/tyler-bloom/bloomtext-homepage-demo-request?utm_campaign=api-access) and we'll send the BAA with your onboarding.

## How the API protects data

| Protection | What it means |
| --- | --- |
| **Least privilege** | Keys carry only the scopes an admin grants, and app users see only the conversations they're in. |
| **Minimal responses** | Users and organizations return only IDs, names, and roles. Passwords, private contact details, and internal fields are never returned. |
| **Signed webhooks** | Every delivery is signed with HMAC-SHA256 and protected against replay. Payloads carry IDs, not message text. |
| **Short-lived downloads** | Export URLs expire quickly and work only for the organization that created the export. |
| **Attributed writes** | Every write is recorded against a named app user with a stable ID, so staff always see what came from an integration. |
| **Instant revocation** | Admins can revoke a key or remove an app user from a conversation at any time. |

All traffic uses TLS 1.2 or later. Plain HTTP requests are refused.

## Your responsibilities

Messages sent through the API are protected health information when they're about patients. Your integration becomes part of your organization's HIPAA program:

- **Store API data like any other PHI.** Encrypt it at rest, restrict who can read it, and log access.
- **Keep keys in a secrets manager.** Rotate them when people leave, and never paste them into chat tools or AI prompts.
- **Send the minimum.** Appointment times and "your forms are ready" are fine. Keep diagnoses and clinical detail out of automated messages unless your compliance team approves.
- **Mind Part 2 data.** If you work with substance use disorder records under 42 CFR Part 2, have your compliance lead approve message templates.
- **Check your AI vendors.** If an AI agent reads BloomText data, the model provider needs a BAA with your organization too.

> **Warning:** Don't include PHI in support requests or the access request form. Share a `request_id` instead.