Harlo Security Kit — Health-Tech Vendor Wording Pack

Answer the health data questions in security reviews — honestly.

Selling to clinics, digital health companies, or health plans? Their security reviews ask about health data: whether you handle PHI, whether you sign a BAA, how you log access to patient records, how fast you report a breach, and what happens to patient data in support tickets and test systems. This pack gives small B2B SaaS teams 25 original, plain-English starting answers for those questions, plus a starter Health Data Handling Policy.

Every answer has a short version, a longer version, an honest "if not yet in place" variant, and a list of evidence to have ready. Honest variants are included for vendors who do not sign BAAs or do not handle PHI. All company details are {{placeholders}} you fill in.

HIPAA-aware wording, not HIPAA compliance. Nothing in this pack makes you or your customers HIPAA compliant. Whether a BAA is needed, and what it says, is your call and your customer's, with your own counsel.

Includes: 25 Q&As (Markdown with YAML front-matter, Notion-importable), CSV answer bank, starter Health Data Handling Policy (with effective and next-review dates), placeholder list.

Important: A starting point, not legal advice, not a certification, and not an audit. It does not make your company meet any standard, framework, or law. Edit every answer and the policy to match what you actually do, and have your own counsel review any contract wording, including any BAA.

License: one organization. No resale. Support: digitalpromohub.support@gmail.com