CareSwaps, LLC is a healthcare technology platform provider. When CareSwaps receives, creates, stores, or transmits PHI on behalf of a participating care facility, CareSwaps acts as a HIPAA Business Associate as defined in 45 CFR § 160.103. A written Business Associate Agreement (BAA) is signed with every Covered Entity before PHI is exchanged.
CareSwaps complies with the HIPAA Privacy Rule (45 CFR Part 164, Subpart E), the Security Rule (45 CFR Part 164, Subpart C), and the Breach Notification Rule (45 CFR Part 164, Subpart D), subject to the terms of the applicable BAA.
CareSwaps may receive or generate PHI in the following categories:
If you are submitting information about a family member, CareSwaps may request documentation of your legal authority to act on their behalf (POA, MDPOA, or guardianship order). We will only accept submissions where the submitter has confirmed in writing that they have lawful authority to share the resident's information. Where applicable, CareSwaps may request a copy of the POA/MDPOA instrument before proceeding with the match.
CareSwaps uses and discloses PHI only as permitted by the BAA with the applicable Covered Entity and by 45 CFR § 164.504(e) and § 164.514. Specifically:
CareSwaps will not use or disclose PHI for marketing, sale, fundraising, or advertising. CareSwaps will not use PHI for any purpose not permitted by the BAA or the HIPAA Privacy Rule.
CareSwaps maintains administrative, physical, and technical safeguards to protect the confidentiality, integrity, and availability of PHI, consistent with the HIPAA Security Rule (45 CFR §§ 164.308, 164.310, 164.312).
All PHI is encrypted in transit using TLS 1.2 or higher. PHI at rest is encrypted using AES-256 equivalent safeguards provided by our BAA-covered service providers (Google Workspace, Jotform HIPAA Gold, Paubox).
All platform traffic is protected by Cloudflare's edge network, including DDoS mitigation and WAF rules. Administrative endpoints require MFA.
Access to PHI is restricted by role. Multi-factor authentication is required for all administrative accounts. Session timeouts and login audit logs are enforced.
All PHI reads, writes, and exports are logged with actor, action, timestamp, and record ID. Logs are retained for a minimum of six (6) years.
PHI is stored exclusively in BAA-covered systems (Google Workspace). Operational systems without BAAs (Airtable, Make.com) receive only de-identified IDs under 45 CFR § 164.514(b) (Safe Harbor) — never names, contact information, care details, or any of the 18 HIPAA identifiers.
CareSwaps maintains a written HIPAA Breach Response Plan. Upon discovery of a potential breach, CareSwaps investigates within 72 hours, notifies the affected Covered Entity within the timeframe required by the applicable BAA, and cooperates with the Covered Entity's Breach Notification Rule obligations.
| Role | Access Scope | Notes |
|---|---|---|
| Privacy / Security Officer | All systems, all PHI | Michael Ford (Founder). MFA required. |
| Platform Administrator | Read/write PHI, admin console | MFA. Background-checked. |
| Support Staff | Ticket-scoped PHI only (when family initiates contact) | No bulk export. Audit-logged. |
| Matching Engine (automated) | Read PHI within BAA scope | Service account. No human reads without audit event. |
| Finance / Billing | Billing fields only. No PHI. | Scoped to Stripe and GL only. |
| Operational Systems (Airtable, Make.com) | De-identified IDs only. No PHI. | Per 45 CFR § 164.514(b) Safe Harbor. |
Under the HIPAA Privacy Rule, you (or your legally authorized representative) have the following rights with respect to PHI that CareSwaps holds:
To exercise any of these rights, email privacy@careswaps.com. We will respond within thirty (30) days, consistent with 45 CFR § 164.524.
In the event of a breach of unsecured PHI, CareSwaps will notify the affected Covered Entity without unreasonable delay and in no event later than sixty (60) days after discovery, in accordance with 45 CFR § 164.410 and the applicable BAA. The Covered Entity is responsible for notifying affected individuals, HHS, and, where applicable, the media.
Where CareSwaps' services create a direct-to-family relationship and CareSwaps has a notification obligation under the BAA, CareSwaps will send a breach notice to the affected family subscriber by the method specified in the BAA.
CareSwaps uses de-identified data in all systems that do not have a signed BAA (Airtable, Make.com). De-identification is performed consistent with the Safe Harbor method in 45 CFR § 164.514(b), removing all eighteen (18) identifiers:
Once de-identified, the record is reduced to operational IDs (e.g., SW-0007, CS-012) and status flags only. No re-identification key is stored in the de-identified system.
CareSwaps has executed Business Associate Agreements with the following service providers whose systems may touch PHI:
hipaa.jotform.com) — BAAStripe is classified as a payment processor under 45 CFR § 164.501 (payment processor exemption). Cloudflare operates as a network service under a DPA; no PHI is persisted in Cloudflare. Airtable and Make.com hold only de-identified data as described in Section 7 above.
CareSwaps applies the HIPAA Minimum Necessary Standard (45 CFR § 164.502(b)). We request, use, and disclose only the PHI reasonably necessary to accomplish the intended purpose of the matching service. Matching uses operational factors only; diagnosis and treatment information are not used by the algorithm.
Federal complaint: HHS Office for Civil Rights — hhs.gov/ocr · Toll-free: 1-800-368-1019.
CareSwaps reserves the right to modify this HIPAA Notice of Privacy Practices at any time, consistent with 45 CFR § 164.520(b). Changes will be posted with a new effective date. We will notify active subscribers by email of any material change.