Security and compliance
The Partner API carries protected health information (PHI). This page covers what Thea does to protect it and what we expect from partners.
Business Associate Agreement
Section titled “Business Associate Agreement”Before Thea issues a live key, your organization and Thea sign a Business
Associate Agreement (BAA) under HIPAA. Until it takes effect, live keys are
rejected with 403 baa-required.
The sandbox needs no BAA because it must never contain real patient data.
What Thea does
Section titled “What Thea does”- TLS everywhere. The API accepts HTTPS only. Files are uploaded through the API, and downloads use short-lived signed URLs.
- Two keys for practice data. Every request about a practice needs your partner key and that practice’s key, so neither alone exposes patient data. Thea stores keys only as hashes.
- Practice-controlled access. A practice admin approves each connection and its scopes, and can disconnect your organization at any time, which revokes the practice key immediately.
- Audit trail. Every request is logged with the key, practice, operation, resources touched, status, and source IP, but not request or response bodies.
- Data minimization. The API never returns Social Security numbers or insurance details. Webhook payloads carry only IDs and non-sensitive fields.
- Practice isolation. A practice key only reaches its own practice. Records in other practices are indistinguishable from records that don’t exist.
What we expect from partners
Section titled “What we expect from partners”- Keep partner keys, practice keys, and webhook secrets server-side, in a secrets manager.
- Verify every webhook signature before acting on it.
- Ask Thea only for the scopes you need, and keep each practice key paired with its own practice.
- Don’t put PHI in the sandbox, in logs you don’t control, or in URLs.
- Tell us promptly at support@theahealth.com if a key or secret may be exposed, or if you suspect a security incident.