Odexy is not a HIPAA-compliant service by default. If you are a covered entity or business associate under HIPAA, do not store protected health information (PHI) in Odexy unless you have a signed Business Associate Agreement (BAA) with us.
HIPAA mode
HIPAA mode is a set of stricter sign-in settings available on plans that include it. When it is on:
| Setting | Standard | HIPAA mode |
|---|---|---|
| Minimum password length | 8 characters | 12 characters |
| Session length | 30 days, renewed while in use | 12 hours |
| Email verification before first sign-in | Not required | Required |
| Email codes as a second factor | Available | Not available (authenticator app, passkey or backup codes only) |
| How quickly a revoked session stops working | About 60 seconds | About 15 seconds |
What HIPAA mode does not do. It does not change how data is encrypted or stored, how long audit records are kept, or which service providers process data, and it does not by itself make your use of Odexy HIPAA compliant.
Business Associate Agreement
If you need to store PHI, contact support@odexy.app with “HIPAA BAA” in the subject before you do. Tell us your organization, what PHI you intend to store, and which modules and features you will use. We will review your use and tell you whether we can sign a BAA for it, and on what terms.
Things to know before storing PHI
- AI features send content to third-party model providers (see our sub-processors page). Do not use AI features on PHI unless your BAA covers them.
- Email that your users send from Odexy to people outside it is ordinary email. Do not send PHI by email unless your own safeguards allow it.
- Connected services — mailboxes, storage buckets, automations and webhooks you set up — are outside our BAA; your agreements with those providers apply.
Your responsibilities
HIPAA compliance is shared. Even with a BAA in place, you remain responsible for your own risk analysis, policies and workforce training; for giving access only to people who need it and removing it when they leave; for reviewing the audit trail; and for how your users handle PHI in the Service.
Contact
BAA requests and HIPAA questions: support@odexy.app.