Can I use Updox and be HIPAA compliant?

Can I use Updox and be HIPAA compliant? | Paubox

We’ve been getting asked by customers and prospects about various telehealth solutions and whether they can use them in a HIPAA compliant manner.

We know the HIPAA industry is vast so we can empathize with just how many people need to use cloud-based services in this sector.

Today we will determine if Updox is a HIPAA compliant telehealth service or not.

About Updox

Updox is a healthcare communication and collaboration platform that helps healthcare providers, payers, and other organizations to manage and improve their interactions with patients and other stakeholders. It is designed to provide a secure, convenient, and efficient way to exchange messages, documents, and other information.

Updox includes a range of features and tools to support healthcare communication and collaboration, such as secure messaging, appointment scheduling, document management, and integration with other healthcare systems and tools. It is available on a range of devices, including desktop computers, mobile phones, and tablets, and can be accessed through a web browser or through dedicated mobile apps.

Updox is designed to meet the strict security and privacy requirements of the healthcare industry, and it is compliant with relevant regulations such as HIPAA. It is intended to help healthcare providers, payers, and other organizations to improve patient care, reduce costs, and increase efficiency by enabling them to more easily communicate and collaborate with each other and with patients.

Updox and the business associate agreement

We’ve previously talked about how a business associate agreement (BAA) is a written contract between a covered entity and a business associate. It is required by law for HIPAA compliance.

We checked the Updox site and found the relevant answers on their Security Statement and Master Service Agreement pages.

For example, the Updox BAA is included as part of exhibit A of their MSA:


Last Modified: 06/10/2021

This HIPAA Business Associate Agreement (“BAA”) amends and is made part of that certain Master Services Agreement (“Service Agreement”), by and between you (“Entity”) and Updox LLC (“Associate”).

Entity and Associate agree that the parties incorporate this BAA into the Service Agreement in order to comply with the requirements of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), the Health Information Technology for Economic and Clinical Health Act (“HITECH”) and their implementing regulations set forth at 45 C.F.R. Parts 160 and Part 164 (the “HIPAA Rules”). To the extent Associate is acting as a Business Associate of Entity pursuant to the Service Agreement, the provisions of this BAA shall apply, and Associate shall be subject to the penalty provisions of HIPAA as specified in 45 CFR Part 160.

Notification of Enforcement Discretion

When the pandemic first hit in March 2020, the U.S. Department of Health and Human Services (HHS) quickly announced the Notification of Enforcement Discretion, which allowed health care providers to use widely available communication apps without the risk of incurring HIPAA fines.

This notice allows health care providers to use popular applications to provide telehealth services, so long as they are “non-public facing.”

Examples of non-public facing applications include:

  • Amazon Chime
  • Apple FaceTime
  • Facebook Messenger
  • Google Hangouts video
  • Google Hangouts
  • iMessage
  • Jabber
  • Signal
  • Skype
  • Spruce Health Care Messenger
  • Updox
  • VSee
  • WhatsApp
  • Zoom

See also: HIPAA privacy and security guidelines as they relate to telehealth

Is Updox HIPAA compliant?

The business associate agreement is a key component to HIPAA compliance between a covered entity and a business associate.

As we noted earlier, Updox is willing to sign a BAA with its customers. In fact, it’s included in their Master Service Agreement.

In addition, Updox is considered by HHS as a telehealth solution that can be used in a non-public facing manner. While the HHS Notification of Enforcement Discretion is not indefinite, it would allow healthcare entities to use Updox and not be liable for HIPAA fines even if they did not offer a BAA to their customers.

Conclusion: Updox is HIPAA compliant.

About the author

Hoala Greevy

Founder CEO Paubox. Kayak fishing when I can.

Read more by Hoala Greevy

Get started with
end-to-end protection

Bolster your organization's security with state-of-the-art email encryption and inbound email security.

Highest rated HIPAA compliant messaging solution on G2

EmailEncryption BestMeetsRequirements MeetsRequirements
SecureEmailGateway MostImplementable Total
SecureEmailGateway Leader Leader
SecureEmailGateway EasiestToUse EaseOfUse
SecureEmailGateway EasiestAdmin EaseOfAdmin
SecureEmailGateway BestUsability Total
SecureEmailGateway BestResults Total
SecureEmailGateway BestRelationship Total
EmailEncryption UsersMostLikelyToRecommend Nps
EmailEncryption MomentumLeader Leader