DATA PRIVACY & PHI
Athlete-owned health records built for healthcare practices.
PHI-ready architecture. Business Associate Agreement available.
DATA PRIVACY
Privacy & website security.
How SteadField handles information on this public website versus your protected health information in the authenticated portal.
What this website does
This website shares general information about SteadField, our services, and educational content. Public pages do not collect or store protected health information.
No medical information online
Please do not submit medical details, symptoms, diagnoses, or insurance identifiers through public forms or chat. Use the authenticated patient portal, or contact us by phone, to discuss your care privately.
Not medical advice
This website is not a patient portal and does not provide medical advice, diagnosis, or treatment. In a medical emergency, call 911 or go to your nearest emergency room.
Where your PHI lives
Patient records, clinical messaging, and care plans are managed in the authenticated portal under a signed BAA, separate from this public website.
Website security
All pages use HTTPS encryption. We do not use third-party advertising trackers, and we do not sell your data.
External links
This website may link to external sites for convenience. SteadField is not responsible for the privacy practices or content of external websites.
HOW WE PROTECT PATIENT INFORMATION
Security controls that map to the PHI Security Rule.
Administrative, physical, and technical safeguards configured to support your compliance program.
Encryption in transit and at rest
All data is encrypted with TLS in transit and AES-256 at rest on US-based cloud infrastructure.
Least-privilege access with MFA
Role-based access controls limit who can see what, enforced with multi-factor authentication for administrative accounts.
Audit logging
Access to records is logged with actor, timestamp, and action, supporting accountability and review.
No model training on your data
We do not use customer data to train AI models. Your content is never used to improve shared models.
Configurable retention and deletion
Retention windows are configurable and records can be deleted on request or on a schedule.
Client data isolation
Each customer environment is logically isolated so your data is not commingled with other customers.
OUR PHI APPROACH
A readiness program, not just a checkbox.
We maintain the documentation and controls healthcare customers need to support their own covered-entity obligations.
BAA with every healthcare client
We execute a Business Associate Agreement with each healthcare customer before any PHI is handled.
Subcontractor BAAs
Our subprocessors that touch PHI are covered by signed BAAs and reviewed regularly.
Annual risk analysis
We conduct an annual security risk analysis and remediate findings on a tracked plan.
Workforce training
Workforce members receive PHI and security training on hire and annually thereafter.
Incident response & breach notification
A documented incident response plan defines containment, investigation, and breach notification per the BAA.
WHAT WE NEED FROM YOU
A few steps to get to a signed BAA.
Before we handle PHI on your behalf, we will walk through these together:
- 1
Confirm your scope of services and the PHI your practice will share.
- 2
Review and sign the Business Associate Agreement we send you.
- 3
Configure role-based access and retention settings for your organization.
- 4
Complete a brief administrative onboarding for your care-team leads.
FAQ
Common questions from healthcare teams.
If you do not see your question here, ask us directly.
REQUEST A BAA
We will send your BAA within one business day.
Tell us about your practice and we will follow up to coordinate execution.
Informational only, not legal advice. Compliance depends on your configuration and a signed BAA.