Security and BAA

BloomText is HIPAA-compliant, and API access requires a signed Business Associate Agreement (BAA). Request API access and we’ll send the BAA with your onboarding.

How the API protects data

Protection	What it means
Narrow reads	Patients are found by ID, phone number, or MRN, with no directory listing or name search. Every read of patient messages or conversations is bounded by a time range, a patient, or a conversation. An API key never reads staff conversations.
Narrow keys	API keys reach patient operations, and with member scopes members and teams, only in the organizations each key was given, and, if you ask BloomText to turn it on, only some phone numbers. No key reads staff conversations. OAuth is limited to org admins and reaches their own conversations plus patient operations.
Secure by default	Messages to patients go by secure link and stay inside BloomText unless an app asks for plain SMS.
Least privilege	Keys carry only the scopes the Owner or IT person chose. Reading and sending are separate scopes.
Admin control	Only an account’s Owners and IT people create API keys, under Settings → Account → API keys, choosing the organizations each key reaches; for an account without the Account page, BloomText creates them. With OAuth, only apps that BloomText has registered under a BAA can request tokens, and only after an org admin approves them.
Short-lived tokens	OAuth access tokens last an hour. Refresh tokens rotate on every use, and reusing an old one after a 30-second retry window revokes the connection. Every connection ends after 12 months.
Attributed writes	Messages sent with an API key come from its API identity, an automated sender staff can see, or today show the key’s name with an API marker. Nothing is sent on behalf of a staff member. Staff always see what came from your system.
Audit logging	BloomText logs every API request with the API key, the endpoint, and the patients, conversations, and messages it returned, and keeps it for six years. Changes an API key makes, like adding a member, also appear in the account’s Audit log for Owners and IT as “API key: name”.
Instant revocation	Owners and IT can revoke an API key, and with OAuth admins can disconnect an app or revoke it for the whole organization. Each takes effect on the next request.
Minimal responses	Users and organizations return only IDs, names, and roles. Passwords, private contact details, and internal fields are never returned.

All traffic uses TLS 1.2 or later. Plain HTTP requests are refused.

Your responsibilities

Messages about patients are protected health information (PHI), so your app becomes part of your organization’s HIPAA program.

Store API data like any other PHI. Encrypt it at rest, restrict who can read it, log access, and keep only what you need.
Protect API keys. Keep keys in a secrets manager (and, with OAuth, your client secret too, with refresh tokens encrypted in your database). Give each system its own key. Never paste any of them into chat tools or AI prompts.
Be clear about what you send. Make sure staff know which messages your integration sends, and and from which sender.
Send the minimum. Keep diagnoses and clinical detail out of automated messages unless your compliance team approves, and never put them in plain SMS (channel: sms).
Mind Part 2 data. If you work with substance use disorder records under 42 CFR Part 2, have your compliance lead approve how your app reads and stores messages.
Check your AI vendors. If an AI agent reads BloomText data, the model provider needs a BAA with your organization too.

Don’t include PHI in support requests or the access request form. Share a request_id instead.