CaseLink relies on a small number of third-party service providers (“Subprocessors”) to operate its referral and clinical communication platform. Some of these Subprocessors process Protected Health Information (“PHI”) on our behalf. Others support the platform without ever touching PHI.
This page is incorporated by reference into every executed CaseLink Business Associate Agreement. It lists the categories of Subprocessors we use and describes the safeguards we require of each.
Our Commitments
For every Subprocessor with access to PHI, CaseLink:
- executes a Business Associate Agreement, consistent with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), before granting access,
- reviews their security posture and privacy practices before onboarding,
- grants only the access required for the specific function they perform, and
- remains responsible for their acts and omissions with respect to PHI as if performed by CaseLink itself.
For Subprocessors that do not process PHI (for example, marketing analytics on the public website), we still require confidentiality and standard commercial security commitments.
Subprocessors with PHI Access
The following categories describe Subprocessors that create, receive, maintain, or transmit PHI on CaseLink’s behalf. Specific vendor names within each category are available on request from Covered Entities under an executed Business Associate Agreement.
| Category | Purpose | Data Region | BAA |
|---|---|---|---|
| Cloud Infrastructure and Hosting | Compute, storage, database, and network services that host the CaseLink Service and Customer Content. | United States | Yes |
| Application Development Platform | Low-code application platform used to build and operate the CaseLink Service. | United States | Yes |
| Transactional Email and Notifications | Delivery of referral notifications, account confirmations, invitations, password resets, and other operational messages. | United States | Yes |
| Application Monitoring and Error Reporting | Uptime monitoring, performance metrics, and error tracing to keep the Service reliable and to investigate issues. | United States | Yes |
| Customer Support Tooling | Support ticketing and communication with customers, including handling of support conversations that may contain PHI. | United States | Yes |
| Data Backup and Recovery | Encrypted backups of Customer Content and disaster recovery capabilities. | United States | Yes |
Subprocessors without PHI Access
The following categories support the CaseLink website and business operations but do not have access to PHI.
| Category | Purpose | Data Region | PHI |
|---|---|---|---|
| Website Hosting and CMS | Hosts the public marketing website at caselink.net. | United States | None |
| Domain and DNS | Domain registration and DNS management for CaseLink domains. | United States | None |
| Website Analytics | Aggregate usage analytics for the public marketing website only. | United States | None |
| Payment Processing | Processing of subscription payments. Full payment card details are collected and processed by the payment processor and are not stored by CaseLink. | United States | None |
| Business Productivity | Internal collaboration tools such as email, calendar, and document storage used by the CaseLink team. Not used to store Customer PHI. | United States | None |
Changes to This List
CaseLink may add, remove, or replace Subprocessors as needed to operate and improve the Service. When we make a material change to the Subprocessors that process PHI, we will:
- update this page and revise the “Last Updated” date,
- execute a Business Associate Agreement with the new Subprocessor before granting access to PHI, and
- provide notice to Covered Entities through the Service, by email, or as otherwise required by an executed Business Associate Agreement.
Covered Entities may request the current list of specific vendor names within each category by contacting us at the address below, subject to an executed Business Associate Agreement or a customary confidentiality arrangement.
Where PHI Is Processed
Customer Content, including PHI, is processed and stored in the United States. CaseLink does not transfer PHI outside the United States.
How This Page Fits
Incorporated by reference. This Subprocessors page is incorporated by reference into every executed CaseLink Business Associate Agreement. Nothing on this page modifies the rights, obligations, or remedies set out in the BAA or under HIPAA. Where the BAA is silent or ambiguous with respect to Subprocessors, this page and the BAA are read together.
Questions
Requests for the current Subprocessor list, diligence questionnaires, and other compliance questions can be sent to our team.