Security & Compliance
A four-schema architecture keeps client data in its own governed space. Role-based access, audit trails, encryption in transit and at rest, a PHI guard on SMS, and scoped AI do the rest. BAAs available.
HIPAA aware ABA software means the controls HIPAA expects are built into the architecture rather than promised in a policy: PHI lives in an isolated database schema, access is granted by role and location, every action is audited, data is encrypted in transit and at rest, and AI features are scoped to what they need. TargetFlo provides these controls and signs a Business Associate Agreement; your center remains the covered entity. See the HIPAA notice and privacy policy for the formal statements.
Four-schema architecture
Isolation is a design principle, not a checkbox. Operational features are wired to ops; only PHI-authorized workflows reach phi.
Reference data: payer list, CPT codes, pipeline stage definitions, course catalog
Non-PHI
Operational data: stage counts, task status, fax queue metadata, training completion, dashboard KPIs
Non-PHI
Users, roles, sessions, location membership, Workspace account links
Non-PHI
Clients, guardians, insurance, documents, eligibility payloads, signed consents — isolated and separately governed
PHI — isolated
KPIs, stage counts, and queue sizes are computed from operational tables. A leadership report never joins to a client row.
Fax payloads and eligibility responses land in phi. Workspace lifecycle touches identity. Nothing crosses without an authorized workflow.
OCR writes to phi under human confirmation. The planned MCP assistant reads ops only and has no connection path to phi.
Controls
Described as what they do — not as certifications we claim.
public, ops, identity, and phi are separate database schemas. PHI is isolated by design, and operational features query ops — not phi.
Intake coordinator, clinician, front office, location manager, org admin, guardian, and external provider each see only what their role and location permit.
Views, edits, downloads, sends, integration actions, and AI calls are recorded with actor, timestamp, and target.
TLS for every connection; encrypted storage for databases and for documents held in Google Cloud Storage.
Outbound text messages are checked for identifiers before send. Guardians get appointment and portal prompts, not diagnoses over SMS.
OCR runs inside the PHI boundary with human confirmation; the planned MCP assistant reads only non-PHI aggregates.
BAAs are available for customers. We sign as your business associate and hold our own subprocessors to the same standard.
We commit to encrypted, regularly tested backups and to hosting customer data in United States regions.
Access & audit
Multi-location ABA providers have coordinators, clinicians, front office, leadership, guardians, and external providers in the same system. Role- and location-based access defines what each one can reach; the audit trail records what they did with it.
Audit trail · sample
Encryption & documents
Every connection to TargetFlo uses TLS. Databases are encrypted at rest. Documents — fax pages, uploaded records, signed consents and SOPs — are stored encrypted in Google Cloud Storage and referenced from the phi schema so there is one copy, one access path, and one audit record.
Browser / API / webhooks
TLS in transit
public · ops · identity · phi
Encrypted at rest
Google Cloud Storage
Encrypted documents, referenced from phi
Role check + audit on every access
Enforced in TargetFlo
Control by control
| Control | What it means for your center |
|---|---|
| Four-schema data architecture | Client and family data cannot be reached by dashboard, task, or AI features. A report on pipeline throughput never touches a name or a diagnosis. |
| Role- and location-based access | A coordinator in one location does not see another location's families. Guardians see only their own child's records in the portal. |
| Audit trail on every action | When a compliance officer asks who viewed a document or sent a message, the answer is one query, not a reconstruction. |
| TLS in transit, encryption at rest | Referral faxes, signed consents, and eligibility responses are encrypted whether they are moving or stored. |
| Documents in Google Cloud Storage | Fax pages and uploaded records live in encrypted object storage, referenced from the PHI schema, with access through TargetFlo only. |
| PHI guard on SMS | Broadcast texts to families are checked for names, dates of birth, and clinical terms before they leave. Staff cannot accidentally text PHI. |
| AI scoped to its input | OCR sees the fax it is reading; compose assist sees the draft; the MCP assistant sees counts. No feature has general database access. |
| Google Workspace least privilege | TargetFlo requests account lifecycle and org unit scopes only. It does not read employee email or Drive files. |
| Business Associate Agreement | A BAA is available for every customer handling PHI in TargetFlo. Subprocessors are covered under their own agreements. |
| Encrypted, tested backups | We commit to regular encrypted backups and periodic restore tests so a bad day does not become a data-loss event. |
| US data residency | We commit to hosting customer data in United States regions, with residency documented in your agreement. |
PHI guard & AI scoping
Text messages and AI assistants are where well-meaning staff and clever tools most often move PHI somewhere it should not go.
Broadcast and one-to-one texts to families are checked before send for names, dates of birth, and clinical terms. Flagged messages are blocked with an explanation. Detailed communication moves to email or the parent portal, where access is authenticated.
See CommunicationsGemini OCR sees the fax it reads and writes to phi under human confirmation. Compose assist sees the draft. The planned MCP assistant for Claude receives server-computed counts and rates only — never a client name, DOB, diagnosis, or insurance ID.
See the AI & MCP AssistantCommitments
Stated as commitments we make in your agreement, not certifications we imply.
Available for every customer. TargetFlo signs as your business associate; infrastructure and AI subprocessors are covered under their own terms.
We commit to regular encrypted backups and periodic restore tests, with retention and recovery objectives documented in your agreement.
We commit to hosting customer data in US regions. Region choices are documented so your compliance team can reference them.
Want the detail? Read: What “HIPAA-aware” software means for ABA centers · HIPAA notice · Privacy policy
FAQ
Book a demo and bring your security questionnaire. We show the four schemas, the audit trail, and the PHI guard live, and send the BAA for review.