Lead360 Health Data Program

Current standard-account status

A privacy policy, encryption setting, or vendor security page does not make an account compliant. Health-data eligibility requires legal agreements, provider eligibility, technical configuration, risk assessment, operating procedures, and customer controls working together.

HIPAA requirements

A US covered entity or business associate may use a cloud service for electronic PHI only when the applicable parties enter a HIPAA-compliant Business Associate Agreement and otherwise comply with the HIPAA Rules. A cloud provider that maintains encrypted ePHI may still be a business associate even if it lacks the encryption key.

• A signed BAA with Lead360 covering the exact approved services.
• BAAs or equivalent downstream terms with every provider that creates, receives, maintains, or transmits PHI.
• A documented risk analysis and risk-management plan.
• Administrative, physical, and technical safeguards appropriate to the data and workflow.
• Access, amendment, accounting, incident, breach, return, and deletion procedures.
• Written allocation of customer and Lead360 responsibilities.

Canadian health and private-sector privacy

Canadian requirements depend on the customer, province, activity, and data flow. Ontario health information custodians remain responsible under PHIPA. Private organizations in British Columbia are generally subject to BC PIPA, while PIPEDA can still apply to personal information crossing provincial or national borders in commercial activity. Other provinces and territories may impose different health or private-sector privacy rules.

A British Columbia business is not automatically subject to HIPAA merely because it offers health or beauty services or buy now, pay later financing. It must still determine its legal role, obtain appropriate consent, limit collection and use, protect personal information, support access and correction, and follow applicable retention and breach obligations.

An approved Canadian configuration must identify custody or control, permitted uses, data locations and transfers, access logging, confidentiality, service-provider restrictions, breach escalation, secure disposal, and individual rights.

Program price and included reviews

The Health Data Program is an optional agency add-on priced at $297 USD per agency each month. It includes application and configuration review for up to 10 individually identified sub-accounts. Provider, cloud, communication, storage, or other usage charges are separate where applicable.

The subscription pays for the program review and ongoing control process. Payment does not make Lead360, an agency, or a sub-account compliant; sign a BAA; approve a provider; or activate PHI processing. Each requested workflow remains blocked until every applicable contract, provider, technical, operational, and legal requirement is verified and Lead360 confirms activation in writing.

Customer-funded eligible providers

Where Lead360 supports customer-owned provider accounts, the agency may purchase an eligible HIPAA or regulated-health plan directly from the provider for the relevant sub-accounts. The customer is responsible for provider fees, account eligibility, its provider agreement, and required BAA. Lead360 is not required to fund third-party subscriptions.

Customer payment alone does not activate a health-data program. Lead360 must verify the provider, data flow, agreement, feature scope, tenant configuration, logging, retention, and deletion path before written approval. Features without an eligible provider or verified control remain prohibited for PHI.

Approval workflow

1. Submit a health-data request identifying jurisdictions, covered-entity status, data types, channels, integrations, providers, and sub-accounts.
2. Complete a data-flow and risk review for forms, CRM, messages, calls, recordings, calendars, automation, AI, exports, support, and backups.
3. Execute the required Lead360 health-data addendum or BAA and every applicable provider agreement.
4. Configure dedicated access, scopes, approved providers, retention, logging, recording, export, and incident controls.
5. Test the exact workflow without real PHI and remediate gaps.
6. Receive written activation identifying approved sub-accounts, features, providers, and restrictions.
7. Review the configuration at least annually and whenever a provider, integration, feature, or data flow changes.

Features that require special review

• Ask360 prompts, model providers, tracing, Memory Brain, vectors, and generated content.
• Call recording, transcription, voicemail, SMS, email, social messaging, and contact-center workflows.
• Customer-built automations, webhooks, API and MCP tools, exports, and third-party pieces.
• Public websites, forms, chat widgets, booking, payments, and customer mini apps.
• Collaboration services, support access, backups, object storage, and disaster recovery.
• Sales360 enrichment or profiling, which must not be used to infer private health status.

Shared responsibilities

Customers remain responsible for minimum-necessary use, workforce authorization, endpoint security, lawful consent, patient notices, record accuracy, access and correction, provider selection, configuration, incident reporting, retention, and instructions. Lead360 is responsible only for the approved service scope and obligations stated in the signed agreement.

Suspension and incident response

Lead360 may isolate or suspend a health-data workflow if an agreement expires, a provider loses eligibility, configuration drifts, prohibited data reaches an unapproved feature, or a security concern arises. Customers must immediately report suspected PHI exposure to [email protected] and follow their own legal and regulatory response duties.

Request program review

Agency administrators can apply from the Health Data tab in Lead360 billing. Do not include patient information in the application. Lead360 will confirm whether the requested configuration is supportable and what agreements, providers, controls, and additional usage costs are required. No health-data use is approved until Lead360 confirms activation in writing.