Public Boundary
Preflix AI's public pages are designed to avoid protected health information. Marketing content, public lookup tools, and general contact forms should not ask visitors to paste bills, account numbers, claim numbers, member IDs, or medical history.
When a user needs account-specific review, the product should direct them to a protected workflow with authentication, transport security, access controls, retention rules, and support channels.
Business Associate Readiness
Some enterprise, employer, advocate, or provider-adjacent use cases may require Business Associate Agreement review. Preflix AI should make that pathway visible and separate from consumer marketing contact.
The BAA process should define permitted uses, safeguards, subcontractor controls, reporting obligations, return or destruction terms, and the support model for privacy requests.
Safeguards
A HIPAA-aware implementation should include administrative, physical, and technical safeguards appropriate to electronic protected health information. Product planning should include access management, audit logs, encryption, secure deletion, workforce training, incident response, and vendor review.
The public website should be honest about status. If a certification or audit has not been completed, the page should describe current controls and current posture without implying completed certification.
Patient Rights Support
Preflix AI can support user workflows that request itemized bills, records, corrections, and dispute documentation. It should not block a user's access to their own documents or make it difficult to export relevant account materials.
Privacy and access requests should have a clear contact path, expected response process, and identity verification appropriate to the request.