Built inside the boundary, not around it.
The contract, first
We sign a BAA, and we name every subprocessor under it.
Before we touch anything that carries PHI, we sign a Business Associate Agreement with your agency. Then your counsel gets the list of every service in the path, so the boundary can be checked against the agreement rather than taken on trust. Where an engagement touches no PHI at all, lead acquisition on its own for instance, we say so rather than paper it.
We are describing an architecture and a contract, not a certification. Humayn holds no certification and does not claim one. Anybody who tells you they are HIPAA certified is describing something that does not exist.
Where a workflow cannot be built inside a BAA-covered boundary, it gets self-hosted or it does not get built. That is a scoping constraint we accept before quoting, not a surprise in week seven.
The other half of compliance
Fifty states, three different legal realities.
Enforceable agreements, with statutory authorisation or settled case law behind pre-birth orders.
Restrictive. Agreements void outright, or narrowed so far that most families deliver across a state line.
No dedicated statute. Access depends on case law and, in practice, on county-level habit.
New York is still the only state that licenses matching programs, and its framework was strengthened in 2025 to require agencies to monitor adherence to informed consent and eligibility standards. Monitoring is a systems problem, which is precisely the kind of thing that should not live in somebody’s memory.
This is why the screening and matching logs matter beyond HIPAA. If a regulator, a court, or your own counsel asks why a particular applicant was deprioritised eighteen months ago, the answer should be a record, not a recollection.
Where PHI travels
Stage by stage, what the data actually is.
A vendor who cannot tell you which of their systems holds clinical data has not mapped it. The audit produces this for your agency specifically. Below is the shape it takes.
Ranking is where the exposure lives.
Two things in this system rank people. Screening decides which files a person reads carefully. Matching decides which pairs a person considers. Both reason over BMI, medical history and mental health history.
A human approving the final decision does not fix this on its own, because by then the ranking has already decided what the human sees. So the safeguards sit on the ranking.
- You approve the criteria and their weighting, in writing, before anything runs.
- Every score and every recommendation is logged with the inputs that produced it, so a decision can be reconstructed months later.
- Nothing is auto-rejected. Low-ranked files still reach a person.
- We review the score distribution with you for patterns nobody intended.
The refusal list
What we will not do, at any price.
- NEVERMove PHI into a tool with no Business Associate Agreement, whatever the feature list says.
- NEVERAuto-reject an applicant. Low-ranked files go to a person; they do not disappear.
- NEVERAutomate clinical interpretation, or any message conveying a medical or legal outcome.
- NEVERApprove a match. No screen in anything we build can do it.
- NEVERSend a message to an applicant or intended parent that no named person is accountable for.
- NEVERTrain anything on your data for use anywhere else.
This list is short on purpose and it is the part of the engagement your team will care about most. It is also the third column of the map the audit produces, where it becomes specific to your agency.
Ownership and exit
You own it, and you can prove we are gone.
What you own
The builds, the prompts, the agents, the criteria and the logs. All of it, from the day each piece ships and is paid for.
Where credentials live
Your accounts, never ours. Access is granted by you per system and is read-only until you decide otherwise.
Documentation
Handed over as each piece ships rather than at the end, so you are never holding a half-built system you cannot see inside.
On exit
Our access is revoked and we tell you exactly what to check to confirm it. Nothing we built stops working because we left.
Written down
Two things your attorney will ask, answered here.
Both of these usually wait for the first call. They are cheaper to check now, so they are on the page.
Where liability sits
Our total liability for an engagement is capped at the fees you paid us in the sixty days before the event behind the claim, and indirect and consequential damages are excluded, including lost profits and business interruption. The engagement is governed by Pakistani law. Disputes go to good-faith discussion first, then to arbitration in Islamabad, in English.
That is sections 13 and 14 of the invoice terms, published in full rather than summarised here. Read the cap before you sign, not after: it is a real limit and your counsel should price it in.
What it costs to run after week twelve
There is no metered tail billed by us, because the accounts are yours. Model and API usage, hosting, and monitoring are billed to your accounts by those vendors at their own published rates. We do not hold the credentials, so we cannot and do not add a margin to any of it.
The roadmap itemises which services your build actually uses and the volume each one is expected to carry, before you sign anything. The only recurring fee that comes from us is the retainer, if you choose to take it, and that is a fixed monthly figure you can cancel.
The audit maps this for your agency specifically.
Where PHI lives today, which tools touch it, which are BAA-covered, and where the perimeter has to move before anything is automated. It is one of the four deliverables, and you keep it either way.
Book a 30-minute call