HIPAA Notice

Last updated: November 12, 2026

Our role as a business associate

Puissant, Inc., which operates DTI Reports, acts as a business associate under HIPAA (45 CFR Parts 160 and 164) for the healthcare organizations that use the Service. We maintain administrative, physical and technical safeguards to protect the confidentiality, integrity and availability of protected health information (PHI).

Business Associate Agreement

A Business Associate Agreement (BAA) between your organization and Puissant must be in place before PHI is submitted. The registration acknowledgment records your organization’s acceptance of our BAA; a copy is available on request from tech@dtireports.com. We use and disclose PHI only to provide the Service and as the BAA and the law permit.

How PHI is protected

• Encryption in transit (TLS 1.2 or 1.3) and at rest (AES-256).
• Two-factor sign-in for every account, automatic sign-out after 15 minutes of inactivity, and access limited to your organization.
• A tamper-evident audit trail of sign-ins, record access, report downloads, exports and administrative actions.
• Encrypted backups, monitoring and security alerting.
• Hosting and AI processing only with providers under business associate agreements. Payments are handled by Stripe under HIPAA’s payment-processing provisions; no PHI is sent to Stripe.
• Reports can be shared only through expiring, revocable links that require the recipient to confirm their email address with a one-time code; each view is logged.

Retention and disposal

PHI is retained for the retention period chosen for each case (7, 10 or 15 years) unless a legal hold applies, then securely destroyed, with each destruction recorded in the audit trail. Customer online access ends 30 days after purchase, but records are not deleted at that point. Archive copies are encrypted (AES-256) and kept only on media under our control.

Breach notification

If we discover a breach of unsecured PHI, we will notify the affected organization without unreasonable delay, and no later than the deadline in our BAA and HIPAA (60 days after discovery), so it can meet its own notification duties.

Reporting a concern

To report a suspected privacy or security incident, use Report an Issue or email tech@dtireports.com. We aim to acknowledge reports within 24 hours.

Patients

Patients should direct requests about their records, including access and amendment, to the healthcare organization that provided their care. We will support that organization as our BAA requires.