Built to support HIPAA. Honest about what that means.
A signed BAA on every plan, encryption in transit and at rest, and the admin controls the Security Rule actually asks for. Here is the full list, and the parts that stay your job.
Signed BAA, every plan
A Business Associate Agreement is the contract HIPAA requires before a vendor touches protected health information (PHI). We sign one with every customer, including the $10 plan. Read about the BAA.
Encrypted in transit and at rest
TLS on every connection and encryption at rest on HIPAA-eligible infrastructure whose providers have signed BAAs with us.
Audit log and retention
Who signed in, who was added, what was deleted. Export the audit log as CSV. Set retention rules and put a channel on legal hold.
What HIPAA asks of a team chat tool
HIPAA's Security Rule does not name apps. It asks a covered entity (your practice) to use vendors that sign a BAA and to put administrative, physical and technical safeguards around PHI. For staff messaging that comes down to a short list.
| Safeguard | What Yodl does |
|---|---|
| Business Associate Agreement | Signed with every customer before PHI enters the workspace. |
| Access control | Invite-only workspaces, roles per channel, private channels, one-click removal of a member. |
| Person or entity authentication | Email verification, passkeys (Face ID, Touch ID), trusted-computer sessions. |
| Automatic logoff | 15-minute inactivity lock on every device. |
| Audit controls | Audit viewer with CSV export. |
| Transmission security | TLS in transit; encryption at rest. |
| Retention and integrity | Retention rules, legal hold, soft-delete with history. |
| Minimum necessary | Push notifications and email notices never include message content. |
| Workforce training and policies | Your responsibility. Our policy template and group chat rules help. |
Why Yodl is not end-to-end encrypted
End-to-end encryption means only the sender's and recipient's devices can read a message. It is great for two people. It is a problem for a practice, because the owner cannot search, retain, audit or export what staff wrote, and cannot remove a message from a phone that walked out the door. Yodl encrypts messages in transit and at rest, and the service can read them so those admin controls work. Slack and Microsoft Teams make the same choice. Longer explanation here.
What stays your job
- Sign the BAA before anyone posts patient information.
- Write a short internal communication policy and train staff on it. Say which tools are approved (Yodl) and which are not (WhatsApp, SMS, Messenger).
- Use the minimum necessary: "Room 3 is ready" instead of a full history in a channel of twelve people.
- Remove people the day they leave. Review members quarterly.
- Require a passcode or biometrics on every phone that has Yodl.
Honest limits
No software is "HIPAA certified"; the government does not certify apps. Yodl is built to support your compliance, not to replace it. Yodl is for staff-to-staff communication; it is not a patient portal and should not be used to message patients. Our AI teammate, when you use it, runs on infrastructure covered by a BAA, and an owner can stop it at any time.
Questions about our safeguards or subprocessors? Email [email protected].
Questions
Do you sign a BAA with a 3-person office?
Yes. Every plan includes a signed Business Associate Agreement, no minimum size.
Where is our data stored?
On HIPAA-eligible cloud infrastructure in the United States, with providers that have signed BAAs with us. Email us for the current subprocessor list.
Can we export our messages and audit log?
Yes. The audit log exports as CSV from the admin panel. Message and file exports are available on request and on the API plan.
Is Yodl HIPAA certified?
No product is. HHS does not certify software. Yodl provides the BAA and the technical safeguards; your practice provides policies, training and sensible use.
What happens when a staff member loses their phone?
Remove the member from the workspace (one click) and their session ends. The app locks after 15 minutes idle anyway, and push notifications never contained message content. Then follow your incident procedure; see our guide on lost phones.
Team chat your clinic is allowed to use.
$10 a month for 5 people, one location and 20 GB. Signed BAA on every plan. Month to month, cancel anytime.