Security and BAA

BloomText is HIPAA-compliant, and API access requires a signed Business Associate Agreement (BAA). Request API access and we’ll send the BAA with your onboarding.

How the API protects data

Protection	What it means
Narrow reads	Patients are found by ID, phone number, or MRN, with no directory listing or name search. Every read of patient messages or conversations is bounded by a time range, a patient, or a conversation. Staff conversations are reachable only through the OAuth token of someone in them.
Two narrow credentials	API keys reach patient operations only. OAuth is limited to org admins for now and reaches their own conversations plus patient operations.
Secure by default	Messages to patients go by secure link and stay inside BloomText unless an app asks for plain SMS.
Least privilege	Tokens carry only the scopes the user approved. Reading and sending are separate scopes.
Admin control	Only org admins can create API keys. Only apps that BloomText has registered under a BAA can request OAuth tokens, and only after an org admin approves them.
Short-lived tokens	OAuth access tokens last an hour. Refresh tokens rotate on every use, and reusing an old one after a 30-second retry window revokes the connection. Every connection ends after 12 months.
Attributed writes	Messages sent with an API key show the key’s name to staff. Messages sent through OAuth appear under the admin’s name, with the app in `sent_via`. Staff always see what came from an integration.
Audit logging	BloomText logs every API request with the API key or the admin and app, the endpoint, and the patients, conversations, and messages it returned. Org admins can review their organization’s log, and we keep it for six years.
Instant revocation	Admins can delete an API key, disconnect an app, or revoke an app for the whole organization at any time, effective on the next request.
Minimal responses	Users and organizations return only IDs, names, and roles. Passwords, private contact details, and internal fields are never returned.

All traffic uses TLS 1.2 or later. Plain HTTP requests are refused.

Your responsibilities

Messages about patients are protected health information (PHI), so your app becomes part of your organization’s HIPAA program.

Store API data like any other PHI. Encrypt it at rest, restrict who can read it, log access, and keep only what you need.
Protect API keys, tokens, and your client secret. Keep keys and the secret in a secrets manager, and refresh tokens encrypted in your database. Give each system its own key. Never paste any of them into chat tools or AI prompts.
Be clear about what you send. Make sure staff know which messages your integration sends, and in whose name: an API key’s or an admin’s.
Send the minimum. Keep diagnoses and clinical detail out of automated messages unless your compliance team approves, and never put them in plain SMS (channel: sms).
Mind Part 2 data. If you work with substance use disorder records under 42 CFR Part 2, have your compliance lead approve how your app reads and stores messages.
Check your AI vendors. If an AI agent reads BloomText data, the model provider needs a BAA with your organization too.

Don’t include PHI in support requests or the access request form. Share a request_id instead.