Porchlight for Communities

HIPAA & Business Associate Agreements

Senior-care compliance teams ask about HIPAA early, and they should. Here is our position, stated plainly — what Porchlight is, what it isn't, and what to do if your organization needs a BAA.

What Porchlight is

Porchlight is a life-story and family-connection program: residents answer warm questions about their lives, staff get a person-centered briefing, and families listen and reply. It is enrichment and engagement software. It is not an EHR, a clinical documentation system, or a medical device, and it is designed to operate without any clinical record: no diagnoses, no medications, no care plans, no treatment notes.

Where health information could appear

We're honest about the edge: a resident telling their life story may volunteer something health-adjacent ("after my surgery in '92…"), and our wellbeing check-in records the resident's own one-tap answer to "how are you feeling today?" — an enrichment observation, not a clinical measure. Whether content like this constitutes PHI under HIPAA depends on your organization's status as a covered entity and how you use the product; many activity-programming uses do not involve Porchlight receiving PHI on your behalf at all. Your compliance team makes that call — and we'll support whichever way it lands.

If you need a BAA

If your organization concludes that Porchlight will receive PHI on its behalf, talk to us before enrolling residents — email team@levelbrook.com. We'll walk through the data flows together and, where a Business Associate Agreement is required, agree the terms and the technical configuration that goes with it (including confirming that every subprocessor in the path is covered by an appropriate agreement). We will tell you honestly if a requirement isn't something we can meet yet — we would rather earn the account later than paper over a gap.

What's true regardless

• Everything on our security page applies to every account: encryption in transit and at rest, tenant isolation, consent records, audit logging of administrative access, and published subprocessors.
• Our Data Processing Addendum binds us as your processor: your data is yours, we process it only on your instructions, and we delete it when you leave.
• We minimize by design. Porchlight asks for a name and, optionally, a room number and a few profile facts — never medical records, and no integration pulls clinical data into Porchlight.

See also: Security · Privacy Policy · Subprocessors