Trust & compliance
Why Kirei Data Doesn't Require a Business Associate Agreement
A plain-language explanation for practice owners, IT contacts, and compliance reviewers evaluating the Kirei Analytics Suite.
Last reviewed September 20, 2026 · Applies to the Kirei Analytics Suite as currently built
Short answer: Kirei Data's analytics tools run entirely inside your browser. Your patient and billing data is never transmitted to, stored on, or visible to any Kirei server. Because Kirei never creates, receives, maintains, or transmits protected health information (PHI) on your practice's behalf, it does not meet HIPAA's definition of a business associate for these tools — so there is no PHI relationship for a Business Associate Agreement to govern.
The HIPAA trigger, precisely
The HIPAA Privacy Rule requires a Business Associate Agreement (BAA) when a vendor creates, receives, maintains, or transmits PHI on behalf of a covered entity (45 CFR §160.103). A BAA exists to bind that vendor to the same safeguards your practice already has to follow. If a vendor's software never actually handles your PHI — never receives a copy, never stores it, never has the technical ability to view it — there is no PHI relationship for a BAA to attach to.
How the tools actually work
Runs entirely in your browser. Each tool is a self-contained web page. The moment you drop a file in, all parsing, calculation, and reporting happens on your own device — the same way a spreadsheet works locally.
Nothing is uploaded. There is no "submit" step that sends your file anywhere. Your Jane, Claim.MD, or 835 export never leaves the device it's opened on.
No third party sees it either. Every code library the tools use is hosted by Kirei itself rather than pulled from an outside CDN, so no outside server — no CDN, no analytics vendor, no ad network — ever receives a network request while a tool is open.
Exports are built locally too. PDF reports and CSV downloads are generated in your browser and saved straight to your device — never generated by, or routed through, a Kirei server.
Usage logging is minimal and disclosed. Opening a tool sends Kirei's own server one thing: which tool, which account, and when. That's it — no file contents, no data extracted from a file, no page activity beyond that single open event. See "What does reach our servers" below.
What does reach our servers
Three things live outside your browser — and none is patient data:
— Your account email address, used only to send a one-time login code.
— Your clinic's account record (name, email, plan), the same basic information any software vendor holds for billing and support.
— Which tool you opened, under which account, and when, with a running count per tool. Used only to understand which tools clinics actually use and how often.
No appointment, claim, patient, or financial record from inside a tool is ever part of that.
What this means for your practice
Because Kirei never receives, stores, or transmits PHI through these tools, a BAA is not applicable to them. You're welcome to cite this page — and this analysis — in your practice's own Security Risk Analysis or vendor inventory as your record of that review.
Scope & limits
- Covers the tools as built today. If a future feature processes data on a server — cloud-saved reports, cross-device sync, cross-clinic benchmarking — that feature will be documented separately and may carry its own compliance basis, potentially including a BAA.
- Doesn't cover what happens after export. Emailing an exported PDF unencrypted, or uploading a report elsewhere, is governed by your practice's own policies, not by Kirei's architecture.
- Not a legal opinion. This page is provided for your internal review. We recommend your own counsel or compliance officer confirm it satisfies your practice's specific requirements.
Questions about this page: support@kireidata.com. See also our Privacy Policy and Terms of Service.
← Back to Kirei Data