HIPAA Compliance in Sparkforge: BAA Signing and Activation

Sparkforge offers an optional, account-wide HIPAA add-on for healthcare and wellness businesses that handle electronic protected health information (ePHI). The add-on enables encryption, audit logging, MFA enforcement, and Business Associate Agreement (BAA) signing directly inside the platform.

Important: HIPAA compliance is a paid upgrade. Sparkforge accounts are not HIPAA compliant by default. Once enabled, HIPAA applies to every subaccount in the account and cannot be turned off.

What HIPAA compliance covers

HIPAA (Health Insurance Portability and Accountability Act) sets data privacy and security standards for handling medical information in the United States. The two HIPAA Title II rules that matter for Sparkforge customers are:

• Privacy Rule — national standards for protecting patient health information.
• Security Rule — standards for protecting electronic patient data, covering administrative, physical, and technical safeguards.

If your business creates, receives, maintains, or transmits ePHI on behalf of a healthcare provider, you and Sparkforge both qualify as Business Associates and need a signed BAA.

What the HIPAA add-on enables

• ePHI encryption at rest and in transit across the platform.
• Audit logging of access and changes to records flagged as containing ePHI.
• MFA enforcement required for every user in the account.
• Signed BAA between Sparkforge and your business, managed inside the platform.
• Account-wide application across every subaccount.

Cost

The HIPAA add-on is US$297 per month, billed at the agency level. The fee covers your full account regardless of how many subaccounts you operate.

How to subscribe and sign your BAA

1. From the agency dashboard, open Settings.
2. Click the Company tab.
3. Scroll to the HIPAA Compliance section.
4. Click Subscribe and confirm the $297/mo charge.
5. Review and sign the BAA presented inline. The signed copy is stored in your account.
6. HIPAA features activate automatically across every subaccount within minutes.

What happens after activation

• All users are required to complete MFA setup on next login.
• Audit logs begin recording access to ePHI-flagged records.
• BAA is downloadable from the same Settings page at any time.
• You can mark specific custom fields and contact records as containing ePHI for tighter logging.

Permanent activation

HIPAA activation cannot be reversed. Sparkforge enforces this because rolling back encryption and audit settings on an account that has handled ePHI creates compliance risk. If you no longer need HIPAA, the add-on can be downgraded only through a documented support request that may take several business days.