Trust Center
HELIX presents its HIPAA workflow safeguards, BAA process, role-based access, audit logging, tenant isolation, and data-handling posture in plain language — with an honest account of what HELIX is and is not, and no unsupported certification claims.
Last reviewed June 15, 2026. This page describes product posture and is not a certification, attestation, or legal advice.
HELIX is a software workflow layer that supports an agency’s HIPAA program. The covered-entity agency remains responsible for its own compliance program.
HELIX is built to support agency HIPAA obligations through role-based access, audit logging, minimum-necessary scoping, and access review. HELIX is a software workflow layer; the covered-entity agency remains responsible for its HIPAA program.
A BAA is executed as part of onboarding before production PHI is processed. Agencies can request the BAA and security packet through implementation; the public site never exchanges PHI.
Production data is hosted on managed cloud infrastructure with encryption in transit (TLS 1.2+) and at rest, environment separation, and least-privilege operational access. Hosting and sub-processor detail is shared under the security packet.
Agency data is isolated per tenant, with location, branch, and service-line permission scoping that keeps skilled, personal care, private duty, billing, and administrative work bounded to the right teams.
Reviewable access and workflow-change history supports periodic access reviews, offboarding, and incident follow-up, so an agency can show who could see and change what.
Marketing, demos, and public examples use synthetic demo data only. This is a hard product rule, not a per-page disclaimer.
Assign owner, administrator, clinical, scheduler, billing, and field-user permissions across configurable role types so staff only reach the workflows they are responsible for.
Each agency tenant is logically separated; location, branch, and service-line scoping create entity-level boundaries so multi-site and multi-line operators keep clean operational walls.
Access and workflow-change history supports reviewable audit trails for permission reviews, operational follow-up, incident review, and security-packet requests.
Configuration targets encryption in transit (TLS 1.2+) and at rest, with least-privilege access and key handling managed outside the public marketing surface.
MFA and SSO planning, session controls, and least-privilege provisioning are scoped during implementation readiness rather than claimed as a certification.
Every public screenshot, product frame, and example uses demo data only. No patient, staff, payer, claim, authorization, member, or agency identifiers appear on this site.
Healthcare buyers deserve a straight answer instead of a badge wall. Here is the honest version.
A HIPAA-aware clinical documentation and agency operations workflow platform for skilled home health, personal care, and private duty, with RBAC, audit logging, tenant isolation, and an executed BAA before production PHI.
HELIX does not, on this public site, claim a completed SOC 2, HITRUST, or other third-party certification. Where a certification or attestation is in progress, it is described as in progress — not as completed.
A current security packet, BAA, hosting and encryption posture, access-control model, and sub-processor information, scoped to a real evaluation rather than a badge.
Final regulatory, payer, clinical, coding, and compliance decisions remain with the agency and its qualified advisors. HELIX provides software and operational tooling, not legal, clinical, billing, or compliance advice.
Bring your security, privacy, and compliance reviewers. The path below is what to expect — no login wall before you can evaluate posture.
No unsupported compliance certification, completed third-party attestation, legal advice, payer certification, outcome guarantee, or clinical compliance guarantee is claimed on this public site. Where an attestation is in progress, it is described as in progress — never as completed.
Ask HELIX AI
Use the guide to explore HELIX modules, care settings, implementation, resources, pricing, and demo readiness.
Do not enter PHI or patient information.
No. HELIX describes security controls and workflow support without unsupported certification claims. Where an attestation is in progress, it is described as in progress, never as completed.
Yes. A BAA is executed during onboarding before any production PHI is processed. The public site never exchanges PHI.
Production data is hosted on managed cloud infrastructure with encryption in transit (TLS 1.2+) and at rest, tenant and entity-level isolation, role-based access, audit logging, and least-privilege operational access.
Yes. Agencies can request the BAA and current security packet through implementation, scoped to a real evaluation rather than a badge.
Yes. Public product frames use demo data only and visibly state that no PHI is shown.
See HELIX in action
Walk through intake, documentation, care plans, scheduling, EVV, authorizations, billing, QAPI, reporting, and mobile workflows without routing through a login wall.