HIPAA Compliance & BAA Policy

CapEngage offers dedicated Healthcare & MedTech solutions designed to assist Covered Entities and Business Associates in complying with the Health Insurance Portability and Accountability Act of 1996 ('HIPAA') and the Health Information Technology for Economic and Clinical Health ('HITECH') Act.

This HIPAA Compliance Statement details the safeguards implemented to protect Electronic Protected Health Information ('ePHI') processed through our omnichannel messaging, appointment reminders, and CRM features.

Covered Entities must execute a formal Business Associate Agreement ('BAA') with CapEngage prior to transmitting or processing ePHI on our platform.

• Enterprise Healthcare Requirement: BAA execution is available exclusively on designated CapEngage Enterprise Healthcare subscription tiers. • Prohibited Standard Use: Customers operating under standard self-serve pricing plans without a signed BAA are prohibited from uploading, storing, or transmitting ePHI through the platform. • Requesting a BAA: Contact healthcare@capengage.com or sales@capengage.com to execute our standard BAA.

For dedicated Healthcare instances, CapEngage enforces the following technical safeguards:

1. End-to-End Data Encryption: ePHI is encrypted in transit using TLS 1.3 and at rest using AES-256 bit encryption with dedicated KMS keys. 2. Access Controls & Authentication: Strict Role-Based Access Control (RBAC), automatic session timeout, and mandatory Multi-Factor Authentication (MFA) for administrative access. 3. Audit Controls & Logging: Detailed immutable audit logging capturing all ePHI access, modifications, exports, and campaign dispatches. 4. Workforce Training & Confidentiality: All CapEngage personnel with access to healthcare infrastructure undergo mandatory annual HIPAA privacy and security training.