Health Information & Data Security
How NursePal relates to HIPAA, and the safeguards we use to protect your account and the documents you upload.
Effective Date: October 16, 2026
How HIPAA Applies to NursePal
The Health Insurance Portability and Accountability Act (HIPAA) governs how health plans, healthcare providers, and their business associates handle patients' protected health information (PHI).
NursePal LLC is a healthcare staffing technology and market-intelligence company. We are not a health plan or healthcare provider, and we do not create, receive, or store patient health records on behalf of hospitals or other covered entities. Our analytics, including Stat, work with staffing market data such as job postings, bill rates, and facility information, not patient data.
Healthcare professionals who use NursePal may choose to upload their own credential documents, such as licenses, certifications, and immunization or health-screening records, to apply for jobs. These are employment-related records that you control. They are generally outside HIPAA, but we protect them with the safeguards described below.
Technical Safeguards
- Encryption in transit: All traffic to NursePal uses HTTPS (TLS).
- Document storage: Uploaded documents are kept in private Amazon Web Services (AWS) S3 storage, encrypted at rest with AES-256, and opened only through time-limited signed links.
- Access controls: Role-based permissions limit what each account type (candidate, agency, hospital, sales, and administrator) can see and do.
- Audit logging: Administrative actions and permission changes are recorded in audit logs.
- Abuse protection: Bot protection on Stat and rate limits on the API and chat.
Account Security
- Passwords are stored only as salted Argon2 hashes, never in plain text.
- Sign-in is also available through Google, Microsoft, and Apple.
- Email addresses and phone numbers are confirmed with one-time codes.
- Sign-in sessions expire automatically and must be renewed.
Service Providers
We use established providers to run parts of the platform, including AWS for hosting and document storage, Twilio for in-app calling, and OpenAI for AI features such as resume parsing. Each provider receives only the data needed for its function. Our Privacy Policy describes what we collect and how it is shared.
Your Documents and Choices
- You decide which documents to upload and which employers to share them with.
- You can view or remove your uploaded documents from your profile.
- You can ask us for a copy of your information or to delete your account by emailing support@nursepal.com.
- If a security incident affects your personal information, we will notify you as required by applicable law.
Legal Notice
This page describes our current practices, which may change as the platform evolves. It is not a certification of HIPAA compliance or of any security standard. No security system is impenetrable, and we cannot guarantee that our measures will prevent all unauthorized access.
For the terms that govern your use of the platform, please review our Terms & Conditions and Privacy Policy.
Questions About Security?
For security questions, procurement reviews, or requests about your data, contact us.
Email: support@nursepal.com