Patient data
Who is responsible for HIPAA?
A loyalty program at a practice knows who your patients are, which treatments they buy and when they come in. Velarya signs a Business Associate Agreement with every practice, on every plan, before any patient data goes in. Sensitive data is encrypted, and access to it is limited and logged.
What Kangaroo says
Kangaroo’s Terms of Service, last revised January 2022, make the customer responsible for deciding whether its products are suitable under regulations such as HIPAA, and say Kangaroo will not be liable if they are not. We found no Business Associate Agreement on its site or in its help center.
Kangaroo Rewards Terms of Service, section 3

