Security and BAA

BloomText is HIPAA-compliant, and API access requires a signed Business Associate Agreement. Request API access and we’ll send the BAA with your onboarding.

How the API protects data

Protection	What it means
Least privilege	Keys carry only the scopes an admin grants, and app users see only the conversations they’re in.
Minimal responses	Users and organizations return only IDs, names, and roles. Passwords, private contact details, and internal fields are never returned.
Signed webhooks	Every delivery is signed with HMAC-SHA256 and protected against replay. Payloads carry IDs, not message text.
Short-lived downloads	Export URLs expire quickly and work only for the organization that created the export.
Attributed writes	Every write is recorded against a named app user with a stable ID, so staff always see what came from an integration.
Instant revocation	Admins can revoke a key or remove an app user from a conversation at any time.

All traffic uses TLS 1.2 or later. Plain HTTP requests are refused.

Your responsibilities

Messages sent through the API are protected health information when they’re about patients. Your integration becomes part of your organization’s HIPAA program:

Store API data like any other PHI. Encrypt it at rest, restrict who can read it, and log access.
Keep keys in a secrets manager. Rotate them when people leave, and never paste them into chat tools or AI prompts.
Send the minimum. Appointment times and “your forms are ready” are fine. Keep diagnoses and clinical detail out of automated messages unless your compliance team approves.
Mind Part 2 data. If you work with substance use disorder records under 42 CFR Part 2, have your compliance lead approve message templates.
Check your AI vendors. If an AI agent reads BloomText data, the model provider needs a BAA with your organization too.

Don’t include PHI in support requests or the access request form. Share a request_id instead.