Play your partSUPPORTLOGINGET STARTED →
EXPLOREWHY GRAJAGENTSLEARNFEESPIONEER
GETREADYANDJUMP.COM · BUILT IN DETROIT
Compliance

HIPAA
FOR SUPPLIERS.

Reference

What HIPAA asks of a supplier. GRAJ is not HIPAA-compliant and signs no BAA, so patient data never belongs on it.

GET STARTED →
Compliance

HIPAA FOR
SUPPLIERS.

HIPAA applies to covered entities and, critically, to the vendors that handle protected health information on their behalf. A supplier who never intended to be in scope becomes a business associate the moment they touch patient data — including in a shipping label.

What to know
Business associate is a legal status
If you create, receive, maintain or transmit protected health information for a covered entity, you are a business associate with direct obligations and direct liability. It is not conferred by signing an agreement; the agreement documents a status the activity already created.
The agreement is a prerequisite, not paperwork
A covered entity may not share PHI with you without a business associate agreement in place. It specifies permitted uses, safeguards, breach notification timing and what happens to data when the relationship ends.
The minimum necessary rule
Use and disclose only the smallest amount of PHI needed for the purpose. For a supplier this usually means questioning why patient identifiers are in a dataset at all — the safest PHI is PHI you never received.
Where suppliers get caught
Rarely in the clinical system. Usually in the ordinary edges: a shipping manifest with patient names, a returns process that photographs a label, a support inbox that receives a chart because somebody replied with one.
Where to go next
SELLING INTO HEALTHCARE.
Healthcare buying is slower, more documented and more regulated than any other channel, and the reason is straightforward: the buyer is not the user, and the consequences of a bad product are not commercial.
Read it
DATA PRIVACY FOR SELLERS.
The moment you sell to a consumer you are processing personal data, and the rules follow the person rather than your address.
Read it
THE PAPERWORK THAT UNBLOCKS SALES.
Compliance in wholesale is not a department — it is a set of documents a buyer asks for at the exact moment they are ready to order.
Read it
GRAJ

READY TO
RUN YOUR GAME ON GRAJ.

Free to join. Participants keep 95% of every transaction; GRAJ takes 5%. Built for 195 countries — payments live in the United States.

GET STARTED →SEE HOW IT WORKSEXPLORE GRAJ