FlowEHR uses the third parties below to deliver its service. Where a subprocessor handles protected health information ("PHI") or other patient data, FlowEHR has a business associate agreement ("BAA") with it before patient data is sent, which requires it, in writing, to limit its use and disclosure of patient data as HIPAA requires and to protect it under the HIPAA Security Rule.
Changes. This list changes as FlowEHR adds capabilities. Before a new subprocessor receives patient data, FlowEHR signs a BAA with it, updates this page, and emails each customer's notice contact at least 15 days in advance. A change needed urgently, to keep the service running, address a security risk or meet a legal requirement, is announced as soon as practicable. Customers may object on reasonable, documented privacy or security grounds. If we cannot resolve the objection, the customer may terminate the affected Order Form for a prorated refund (MSA Modification 4.8). Tools that never receive patient data are not listed. To be notified, email legal@flow-ehr.com.
All patient data is stored in the United States. Remote access from India is described in FlowEHR's BAA (Section 3.1); each vendor's processing location is listed below.
Hosting and infrastructure
| Vendor | Purpose | Location | Patient data | BAA |
|---|---|---|---|---|
| Amazon Web Services, Inc. | Cloud hosting for the FlowEHR clinical data platform (FHIR server, database, file storage), telehealth (Amazon Connect, Amazon Chime SDK), speech recognition (Amazon Transcribe) and AI model hosting (Amazon Bedrock) | United States (AWS U.S. regions) | Yes | Yes |
| Vercel Inc. | Application hosting and server functions that pass patient data, including encounter audio, between the browser and FlowEHR's services | United States | Yes (in transit through server functions; function logs) | Yes |
AI and speech recognition (Model Providers)
| Vendor | Purpose | Location | Patient data | BAA |
|---|---|---|---|---|
| OpenAI, L.L.C. | Speech-to-text for ambient documentation, dictation and voice commands, and speaker separation (encounter audio is sent from the clinician's browser, directly or through FlowEHR's servers) | OpenAI API infrastructure; no storage of encounter audio under FlowEHR's zero-data-retention terms | Yes, including encounter audio | Yes |
| Amazon Web Services, Inc. (Amazon Bedrock, Amazon Transcribe) | Language models (Anthropic's Claude models, run inside AWS) for drafting notes, letters and summaries, coding suggestions, and document and photo classification; streaming speech recognition | United States (AWS U.S. regions) | Yes | Covered by the AWS BAA above |
Software development and support
| Vendor | Purpose | Location | Patient data | BAA |
|---|---|---|---|---|
| Hike Health | Software development, maintenance and technical support for the FlowEHR platform | United States and India (remote access only; patient data stays stored in the United States — see BAA § 3.1) | Yes (remote access) | Yes |
Clinical services
| Vendor | Purpose | Location | Patient data | BAA |
|---|---|---|---|---|
| DoseSpot (Dosespot, LLC) | E-prescribing | United States | Yes | Yes |
| Daily (Daily.co) | Video visits through FlowEHR's video-visit link (not recorded) | Daily's real-time media network; no recordings are stored | Yes, live audio and video of visits | Yes |
Patient communications
| Vendor | Purpose | Location | Patient data | BAA |
|---|---|---|---|---|
| Email delivery provider — to be added | Patient portal invitations, appointment confirmations and reminders | — | Will include patient name and email address, practice name, and appointment details. No clinical notes. | FlowEHR will name this provider, with a signed BAA, under the notice process above before it sends any patient email |
Security and anti-abuse (no PHI)
| Vendor | Purpose | Location | Patient data | BAA |
|---|---|---|---|---|
| Cloudflare, Inc. (Turnstile) | Bot protection on public online-booking pages | Global | No. Sees a browser challenge token and IP address only | Not required |
Services a practice contracts with directly (not FlowEHR subprocessors)
| Vendor | Purpose | Patient data |
|---|---|---|
| Stripe, Inc. | Card payments at online booking, processed on the practice's own Stripe account under the practice's agreement with Stripe | Card details that patients enter on Stripe's payment form, and opaque FlowEHR reference numbers. FlowEHR sends Stripe no clinical information. HIPAA does not require a BAA for payment processing (Social Security Act § 1179, 42 U.S.C. § 1320d-8). |
Business operations (no patient data)
These vendors handle information about FlowEHR's customers and website visitors, never about patients. They are listed for completeness; see the Website Privacy Policy.
| Vendor | Purpose | Patient data |
|---|---|---|
| Vercel Inc. | Marketing website hosting and privacy-friendly, cookie-free page analytics | No |
| Formspree, Inc. | Website contact and demo-request forms | No |
| Cal.com, Inc. | Demo scheduling | No |