Health information · Last updated 30 October 2026
Health information, HIPAA and Kura Notes
The short version. Kura Notes LLC never creates, receives, maintains or transmits notes or any information about the people you support. Those stay on the caregiver's device. Because of that, Kura Notes LLC is not a HIPAA business associate and does not sign Business Associate Agreements. Whether and how Kura Notes may be used in a HIPAA setting is the user's and their employer's decision and responsibility.
This page is for caregivers, agency compliance officers and anyone deciding whether Kura Notes fits their rules. It describes how Kura Notes is built and what we receive. It is not legal advice and it is not a statement that any use of Kura Notes complies with HIPAA or any other law. Ask your own privacy officer or lawyer.
1. The information boundary
| Stays on the caregiver's device, never received by Kura Notes LLC | Received by Kura Notes LLC (about the customer only) |
|---|---|
| Notes, drafts, addenda, incidents, medicines and doses, goals, appointments, visits, the labels or names of people supported, the calendar, monthly and quarterly summaries, templates, the activity ledger, backups and exports | The customer's email address, licence key and plan status, a random identifier and type (for example "Windows PC") for each device using the key, the app version, a count of signed notes (a number only), the 6-digit sign-up code (as a one-way hash, kept 48 hours), and billing status from Stripe |
The app checks every request before it leaves the device: a request to any other address, with any other field, or containing the label of someone in the notes, is stopped. Users can see this in the app under More, then What leaves this device. Notes leave the device only when the user copies, prints, exports, backs up, or moves them to another device by camera, and then they go where the user puts them, not to us.
2. Why Kura Notes LLC is not a business associate
Under HIPAA, a business associate is a person or company that creates, receives, maintains or transmits protected health information on behalf of a covered entity or another business associate. Kura Notes LLC does none of these: there is no server, cloud copy, sync, sharing link or support process that touches note content, and the software runs on the user's own device. A software maker whose product stores data only on the customer's own equipment, and who has no access to that data, is generally not a business associate. For that reason we do not sign Business Associate Agreements, and signing one would wrongly suggest that we handle information we never see.
3. What this means for users and employers
- A caregiver who works for a covered entity (or a business associate) must follow that employer's policies, including whether personal devices and outside tools may be used, device locking, and where records must be kept.
- The employer decides whether Kura Notes may be used and on which devices. It remains responsible for its own HIPAA obligations, including risk analysis, device policies, training and the official record.
- Anything a user exports, copies, prints or backs up becomes part of wherever they put it, under that place's rules.
- Users should keep direct identifiers out of Kura Notes (see the Acceptable Use Policy). The app records people by labels.
4. Safeguards on the device
Notes are encrypted on the device with a key protected by the user's PIN (6 digits or more), with optional fingerprint, face or Windows Hello unlock checked by the device itself. Signed notes are sealed with a SHA-256 hash and every action is written to an append-only, hash-chained activity ledger on the device. These are design features, not certifications; Kura Notes has not been certified by anyone for HIPAA, and no such government certification exists.
5. Questions
Compliance officers can write to admin@kuranotes.org. Please never send us a note or information about a person supported.