HIPAA, the honest version.

Why the hash-only architecture is the most important fact

HIPAA covers Protected Health Information (PHI). The most common HIPAA breach scenario in SaaS is a vendor that stores PHI in a database that gets exfiltrated, accessed by unauthorized staff, or leaked through a misconfiguration.

StampRight does not receive your files. Every stamp computes a SHA-256 hash in your browser before anything is sent to our servers. The file body — the actual patient record, X-ray, intake form — never leaves your device. We can't leak what we never had.

The hash itself is content-free: it's a fixed-length cryptographic fingerprint that cannot be reversed into the original content. By itself, a SHA-256 hash is not PHI.

The HIPAA risk surface is the metadata envelope — the structured fields you optionally include alongside the hash (parties, subject description, dates, identifiers). Customers in healthcare should follow the guidance below.

What we will sign — and when

StampRight signs Business Associate Agreements with Enterprise customers whose use case requires it. The current process:

1. Email hello@stampright.com with "BAA request — [your org]" in the subject. Include your covered-entity status and a brief description of the use case.
2. We provision a HIPAA-segregated tenant: dedicated subprocessor stack with BAA-eligible substitutes for any default tool that doesn't sign BAAs (notably Resend → Postmark or AWS SES).
3. We execute a mutual BAA based on the StampRight template (or yours, subject to review).
4. You get an Enterprise contract with the BAA attached and signed-off subprocessor list.

Timeline: typically 5–10 business days from request to executed BAA.

Subprocessor status (HIPAA-relevant)

Guidance for healthcare customers

Until your BAA is executed, follow these practices to keep your StampRight usage HIPAA-defensible:

• Stamp hashes, not PHI. Compute the hash of the patient record in-clinic. Stamp the hash + a non-PHI label (e.g., "incident report 2026-05-15-A"). Keep the file local.
• Strip identifiers from the metadata envelope. Don't put patient name, MRN, DOB, or any HIPAA-identifying field into the metadata. Use internal reference codes only.
• Use identity binding. Stamps are pinned to the verified identity of the clinician who created them. This is your audit trail.
• For receipts that DO need PHI in metadata (e.g., a court-evidence-ready record with patient name), wait until your BAA is executed.

What we are working toward — the certification roadmap

Posture today is one thing; an audited compliance certification is another. We are tracking toward:

• Formal Risk Assessment under 45 CFR § 164.308(a)(1)(ii)(A) — Q3 2026
• Designated Privacy Officer + Security Officer — Q3 2026
• Workforce HIPAA training program — Q3 2026
• HITRUST CSF readiness assessment (third-party) — Q4 2026
• SOC 2 Type II (parallel track, audit window opens Q3 2026) — report Q1 2027

We'll publish each milestone on the compliance page as it lands. No certifications are claimed until the underlying audit reports are signed.

What we will not say

You will not see StampRight describe itself as "HIPAA compliant" on its website, sales materials, or in conversations with prospects. The phrase is meaningless in isolation — HIPAA imposes obligations on covered entities and their business associates, not on software products in the abstract. We say "HIPAA-aligned posture with BAAs available" because that's what's actually true.

Questions or BAA requests

Email hello@stampright.com with subject line "BAA request" or "HIPAA question." Privacy-specific concerns: privacy@stampright.com.

Last updated: May 15, 2026. This page describes our current posture and is not a substitute for legal advice. Healthcare customers should consult their own compliance counsel before deploying any new system that processes PHI.