Security and HIPAA for end-of-life doulas

    The technical safeguards Liminal Desk uses to protect your practice data and your clients' health and personal information

    Our position, plainly

    Liminal Desk is built to HIPAA-level technical safeguards. We do not claim HIPAA certification or compliance, and we do not currently sign Business Associate Agreements (BAAs). Most private-pay doulas are not HIPAA covered entities, but the information you hold deserves this level of protection either way.

    Technical safeguards

    Encryption in Transit & at Rest

    Connections to Liminal Desk use TLS encryption, and stored data is encrypted at rest by our hosting provider.

    Row-Level Security (Data Isolation)

    Every database query is filtered by your authenticated identity. Your data is invisible to other practitioners at the database level, not just in the app.

    Automatic Session Timeout

    You are signed out after 15 minutes of inactivity, so an unattended device doesn't leave client records open.

    Authentication & Access Control

    Accounts require email verification before access. Anonymous sign-ups are disabled. Only verified users can reach practice data.

    Signature Audit Trail

    Digital agreement signatures are recorded in append-only audit records with IP address, browser details, timestamp, and signer identity.

    Client Portal Links

    Family portal links use cryptographically random tokens that expire and can be revoked. Families see only what you choose to share, no account required.

    Infrastructure & Storage

    Data is hosted with a cloud provider that maintains a SOC 2 Type II report and automated backups. Uploaded documents are kept in private, per-practice storage folders.

    Electronic Signatures

    Signatures are designed around the ESIGN Act and UETA: explicit consent, the signer's typed name, and a certificate of completion with a fingerprint of the exact document signed.

    Path to formal HIPAA readiness

    Technical safeguards are one part of HIPAA. Formal readiness would also require the steps below. They are on our roadmap; none is complete yet.

    • A signed BAA with our hosting provider, so we can offer BAAs to practices that need them.
    • A written security risk assessment.
    • Documented security, incident-response, and breach-notification policies.
    • An independent outside security review.

    Does HIPAA apply to your doula practice?

    Most independent, private-pay end-of-life doulas are not HIPAA covered entities. You typically become subject to HIPAA as a business associate only when a hospice, hospital, or other covered entity engages you and discloses protected health information so you can perform a function on its behalf. If that describes your work, Liminal Desk is not yet the right place for that information.

    Read the full guide: HIPAA compliance for death doulas

    Your responsibilities as a practitioner:

    • Use a strong, unique password for your account.
    • Do not share your login credentials with anyone.
    • Lock your device when stepping away during sessions.
    • Share client portal links over channels the family controls.
    • Review and update advance directive records regularly with clients.

    Security questions or a concern to report? Email abby@liminaldesk.com.