Health Information & HIPAA

Last updated: July 4, 2026 · See also our Privacy Policy and Terms & Conditions.

Because our subscribers participate in drug-testing and recovery programs, we get asked how UA Buddy relates to health-privacy laws like HIPAA. We believe in answering that precisely rather than waving a compliance badge. Here is exactly how it works.

What UA Buddy is — and isn't

UA Buddy is an independent notification service. We listen to the same publicly dialable color-line announcement you would call yourself, and we tell you what it said. We are not a healthcare provider, health plan, or healthcare clearinghouse, and we are not part of your treatment program.

HIPAA, in plain terms

The Health Insurance Portability and Accountability Act (HIPAA) governs "covered entities" — healthcare providers, health plans, and clearinghouses — and their "business associates" who handle protected health information (PHI) on their behalf.

For individual subscribers, UA Buddy is not a HIPAA covered entity or business associate: you sign up directly with us, you tell us your own color assignment, and the daily announcement we relay is played by your program to anyone who dials a public phone number. We receive no records, results, or any information from your treatment provider.

That does not mean your information is unprotected — it means the protections come from our Privacy Policy, our contracts, and consumer-privacy laws. We hold ourselves to the spirit of health-information privacy regardless of whether the letter of HIPAA applies:

We collect no medical records, diagnoses, or test results — only your contact info, program name, and color.
We never sell or share your information for marketing. Being a UA Buddy subscriber is nobody's business but yours.
Everything is encrypted in transit; storage is access-controlled; deletion is yours for the asking.

42 CFR Part 2 (substance-use confidentiality)

Federal law (42 CFR Part 2) gives records held by substance-use treatment programs extra confidentiality protections. Those obligations sit with treatment programs and entities that receive records from them. UA Buddy receives no Part 2 records from any program. We will never ask your program for information about you, and we will never disclose to anyone that you receive alerts from us except as required by law.

For courts, probation offices & treatment programs

If your organization onboards UA Buddy to notify your clients and shares client information with us (for example, a roster of participants and color assignments), we may then be acting as your business associate or as a "qualified service organization" under Part 2. For organizational clients we will, upon request:

Sign a Business Associate Agreement (BAA) or Qualified Service Organization Agreement (QSOA);
Limit use of client data strictly to delivering notifications;
Support your data-retention and deletion requirements;
Report any security incident affecting your clients' data promptly.

Questions

If anything here is unclear, or you want the account data we hold about you, email hello@uabuddy.com. This page is provided for transparency and is not legal advice.