HIPAA, Protected Health Information (PHI), and Business Associate Agreements (BAA)

The short version

Wocket is designed to support private care businesses that need to work with Protected Health Information (PHI). When your use of Wocket requires a Business Associate Agreement (BAA), Cog Mission will enter into a BAA with your organization.

There is an important boundary:

Until then, do not put PHI into Wocket. If you're not sure where your business falls, that's exactly the kind of question we'd rather answer with you than leave you to decode from a policy page. Contact us for a 1:1 review with your team and legal counsel as appropriate.

1. Purpose & Scope

This document explains how Wocket approaches HIPAA, Protected Health Information (PHI), and Business Associate Agreements (BAAs). It is written for organizations using Wocket in environments where health information may be created, received, maintained, or transmitted.

It explains:

• where PHI belongs in Wocket
• when a BAA is required
• the security controls applied to sensitive information
• what Wocket is designed to support
• what Wocket is not designed to replace
• what customers are responsible for when using the platform

This document does not replace legal advice or your organization's HIPAA policies and procedures.

2. HIPAA & Wocket

HIPAA is a framework for protecting certain health information and establishing requirements around how that information is handled.

Wocket is designed with those requirements in mind.

Cog Mission has spent years building systems around security, access control, encryption, and careful handling of sensitive business information. Healthcare Documentation extends that same discipline to health-related information when HIPAA requirements apply.

Your organization's role, the information you collect, how you use it, and whether a Business Associate Agreement is required all matter.

That's why we treat the BAA as a real boundary — not a checkbox.

3. Private Senior Care

For private senior care, Wocket's job is to organize the business around the care.

The relationship stays human.

Typical private senior-care services may include:

• Companionship
• Personal-care assistance
• Meal preparation
• Light housekeeping
• Mobility assistance
• Appointment accompaniment
• Respite for family caregivers
• Medication reminders

Medication reminders may appear as schedule or task cues.

Wocket does not position itself as medication-administration software. Medication administration is only appropriate where it is legally within the aide's scope of practice and permitted by applicable state rules and certifications.

4. PHI & Where It Belongs

Personally Identifiable Information (PII)

Everyday business information such as a person's name, phone number, address, appointment, or schedule may be part of normal Wocket operations.

Protected Health Information (PHI)

PHI is health information that identifies, or can reasonably be used to identify, an individual.

Examples may include:

• Detailed care notes that reveal health status
• Medical history
• Clinical medication information
• Diagnoses or condition information
• Physician or care-team information
• Other health information connected to an identifiable person

Where PHI belongs

PHI should not be placed in ordinary job notes, general CRM notes, chat, marketing analytics, screenshots, invoice descriptions, or other areas not designed for PHI.

Healthcare Documentation is available for PHI only when the appropriate Business Associate Agreement is active.

5. Where Wocket Fits — and Where It Doesn't

Wocket is built for

• Running the private senior-care business
• Managing leads and consultations
• Managing service agreements
• Building recurring schedules
• Coordinating visits and tasks
• Invoicing and collecting payments
• Following up with families
• Maintaining appropriate care documentation
• Supporting PHI workflows within Healthcare Documentation when a BAA is active

Wocket is not

• A hospital Electronic Health Record (EHR)
• A physician practice management system
• A prescribing system
• A medication-administration system
• A substitute for clinical judgment
• A replacement for required clinical systems
• A reason to place PHI into ordinary business notes

6. Business Associate Agreements (BAA)

Cog Mission will enter into a Business Associate Agreement when required.

A BAA establishes the responsibilities of the parties when a business associate handles PHI on behalf of a covered entity or another business associate.

Before your BAA is active

Do not store PHI in Healthcare Documentation.

And never put PHI into ordinary Wocket job notes, general notes, chat, marketing analytics, screenshots, or invoice descriptions.

When your BAA is active

Healthcare Documentation can be used for the PHI categories supported by Wocket.

Those may include:

• Detailed care documentation
• Medical information
• Medication information
• Diagnoses and conditions
• Physician and care-team information
• Other PHI appropriate to the supported documentation workflow

A BAA does not make every possible use of Wocket compliant. Your organization remains responsible for using the platform appropriately and following its own HIPAA policies and procedures.

7. Security Controls for PHI

Wocket's broader security program includes controls designed to protect customer and sensitive information.

For information handled within Healthcare Documentation, relevant controls include:

• Encryption in transit
• Encryption at rest
• Role-based access control
• Company and user access boundaries
• Authentication and authorization controls
• Audit events for relevant PHI activity
• Controlled export of supported PHI categories
• Security monitoring and incident-response procedures

Our broader security practices are described in the Information Security & Data Protection Policy.

8. Healthcare Documentation & Export

Healthcare Documentation provides a dedicated place for supported health-related documentation.

When a BAA is active, supported PHI categories may be exported as part of a care packet.

Examples include:

• Detailed care notes
• Medical information
• Medication information
• Diagnoses
• Physician information
• Other Protected Health Information (PHI)

The purpose is straightforward:

9. Customer Responsibilities

Security and compliance are a shared responsibility.

Wocket provides technical controls and product boundaries. Your organization is responsible for how your people use the platform.

That includes:

• Training staff on appropriate handling of PHI
• Keeping credentials secure
• Using appropriate access permissions
• Keeping PHI out of ordinary notes and communications
• Following applicable state and federal requirements
• Maintaining your own HIPAA policies and procedures
• Determining when a BAA is required
• Obtaining appropriate legal or compliance advice for your specific organization

If you're unsure whether something belongs in Healthcare Documentation, ask before entering it.

That's a much better outcome than discovering the boundary after the fact.

10. Questions & Legal Review

HIPAA can get complicated quickly.

Your organization may be a covered entity, a business associate, a subcontractor, or something else entirely. The right answer depends on what you do, whose information you handle, and how Wocket is being used.

We would rather talk through those details with you than give you a 40-page answer that doesn't fit your Tuesday.

Questions: [email protected]

Bring your HIPAA and BAA questions to a 1:1 with Cog Mission. We can walk through the product boundaries and involve legal counsel when appropriate.

For plain-English definitions of HIPAA, PHI, BAA, PII, EHR, and related terms, see the Dictionary.

This document describes Wocket's product and security approach. It is not legal advice and does not replace your organization's HIPAA policies, procedures, risk assessment, or legal counsel.