--- title: "Workfolio HIPAA Compliance & Security | Workfolio" description: "Healthcare organizations handle some of the most sensitive information." canonical: "https://www.getworkfolio.com/hipaa" --- # Workfolio HIPAA Compliance & Security ## Built with Privacy and Security in Mind Healthcare organizations handle some of the most sensitive information. When employees use Workfolio, their work activity may include information that could potentially contain Protected Health Information (PHI). Workfolio maintains security and privacy practices designed to support applicable HIPAA requirements and help protect sensitive customer information. From access controls and security testing to employee training, screenshot retention, and deletion controls, we take a comprehensive approach to protecting the information entrusted to us. ### Designed with PHI protection in mind Workfolio is a workforce productivity platform, not a healthcare record system. However, information captured through Workfolio, particularly screenshots, may potentially contain PHI depending on what is displayed on an employee's screen. For this reason, we have designed our security, privacy, and data retention practices with the potential presence of sensitive information in mind. We apply administrative, technical, and organizational safeguards designed to protect customer data against unauthorized access, use, disclosure, alteration, or loss. --- ## Our Security Practices ### Multi-Factor Authentication We use Multi-Factor Authentication (MFA) to provide an additional layer of protection against unauthorized access to accounts and systems. ### Penetration Testing We conduct penetration testing to identify potential vulnerabilities in our applications and infrastructure. Identified issues are reviewed and addressed as part of our ongoing security program. ### Annual Security Risk Assessments We conduct annual security risk assessments to identify potential threats and vulnerabilities and evaluate the effectiveness of our security safeguards. ### Employee Security Training Our employees receive security awareness training to help them understand their responsibilities when handling customer information and maintaining the security of Workfolio systems. ### Access Controls Access to customer information and systems is restricted to authorized personnel based on business need and appropriate access controls. We work to limit access to sensitive information wherever possible. ### Data Protection We maintain administrative, technical, and organizational safeguards designed to protect customer information and help maintain its confidentiality, integrity, and availability. ### Security Monitoring & Incident Response We maintain processes for identifying, investigating, and responding to security incidents that may affect customer information. We continuously review and improve our security practices as technology, security threats, and regulatory expectations evolve. --- ## Screenshot Privacy & Retention Screenshots captured by Workfolio may potentially contain sensitive information, including PHI, depending on what is displayed on an employee's screen. Because of this, we have specific controls for screenshot retention and deletion. ### 90-Day Screenshot Retention Captured screenshots are automatically deleted after **90 days** in accordance with our screenshot retention policy. This helps minimize the amount of potentially sensitive information retained within Workfolio and reduces unnecessary long-term exposure. ### Customers Can Delete Screenshots at Any Time Customers also have the ability to delete captured screenshots before the 90-day retention period. When a screenshot is deleted by the customer, it is **deleted immediately from Workfolio's active systems**. ### No Backup Copies After Deletion When a customer deletes a screenshot, Workfolio does **not maintain a backup copy of that deleted screenshot**. This is particularly important for screenshots that may contain PHI. Once deleted, the screenshot is not retained as a separate backup copy by Workfolio. Our approach is designed to give customers greater control over potentially sensitive information captured by Workfolio. --- ## Business Associate Agreements Workfolio supports Business Associate Agreements (BAAs) for eligible customers. **Pro and Premium customers can request a BAA by contacting our team at [team@getworkfolio.com](mailto:team@getworkfolio.com).** A BAA establishes the permitted uses and disclosures of PHI and defines the parties' responsibilities for protecting PHI in accordance with applicable HIPAA requirements. If your organization is subject to HIPAA and your use of Workfolio involves PHI, contact our team to discuss your requirements and the BAA process. **Request a BAA:** [team@getworkfolio.com](mailto:team@getworkfolio.com) --- ## Our Commitment to Protecting Customer Information Our security and privacy program is built around several key principles: - **Protect sensitive information** with appropriate administrative, technical, and organizational safeguards - **Limit access** to customer information to authorized personnel - **Strengthen account security** through Multi-Factor Authentication - **Identify vulnerabilities** through regular penetration testing - **Assess security risks** through annual security risk assessments - **Train employees** on security and data protection responsibilities - **Minimize data retention** through defined screenshot retention policies - **Give customers control** over screenshot deletion - **Delete customer-selected screenshots immediately** from active systems - **Do not maintain backup copies** of screenshots after customer deletion - **Continuously improve** our security and privacy practices --- ## Designed for Organizations That Take Privacy Seriously Workfolio is designed for organizations that need visibility into workforce activity while taking privacy and security seriously. We understand that screenshots and other work activity data may contain sensitive information. Our security controls and data retention practices are designed to help organizations protect that information while using Workfolio. We continuously work to strengthen our security controls, processes, and safeguards as technology, security threats, and regulatory expectations evolve. --- ## Questions About HIPAA and Workfolio? If you have questions about Workfolio's HIPAA practices, security controls, screenshot retention, or Business Associate Agreements, our team is happy to help. **Contact us at [team@getworkfolio.com](mailto:team@getworkfolio.com)**