What HIPAA-aligned means, and why it matters for a retreat

What is HIPAA

HIPAA is the Health Insurance Portability and Accountability Act, a United States federal law passed in 1996. It sets the national rules for protecting health information that can identify a person, which the law calls protected health information. Three parts matter most here:

• The Privacy Rule decides who may see and use your health information, and for what.
• The Security Rule requires safeguards for health information kept electronically: who has access, how it is encrypted, how every access is recorded, how it is backed up.
• The Breach Notification Rule requires that the people affected are told when their information is exposed.

HIPAA applies to US health providers, insurers and the companies that handle health information on their behalf. Those companies sign a Business Associate Agreement (BAA): a contract that binds them to the same safeguards and makes them answerable for them.

What "HIPAA-aligned" means for us

Bwiti Life is on the Mayan Riviera near Cancun, Mexico, so HIPAA does not bind us as law. Mexican law does: it treats health information as sensitive personal data that can only be processed with your express consent. Many of our guests come from the United States and expect the protection they have at home, so we chose to hold the medical information we collect to HIPAA's safeguards, and we keep it with a provider that has signed a Business Associate Agreement.

That is all "HIPAA-aligned" means, and we say it carefully on purpose. There is no such thing as being "HIPAA certified": the US government does not certify anyone. A retreat center that shows a "HIPAA certified" badge is telling you something that does not exist.

How we protect your medical information

This covers your health assessment: your answers and the documents you upload with it.

• Stored on Amazon Web Services, under a HIPAA agreement. Your answers and documents are kept on Amazon Web Services (AWS), the cloud used by hospitals and health services, in a private storage area reserved for medical information and covered by a Business Associate Agreement.
• Encrypted on the way and at rest. Everything you send travels over an encrypted connection (HTTPS) and is stored encrypted (AES-256) with an encryption key that belongs to Bwiti Life. Any unencrypted connection to the storage is refused.
• Kept apart from everything else. Your medical information is not kept with our general client records or in our email. Those only note that your assessment has been received.
• Seen only by the people who need it. Only the members of our team in charge of your health review can open your file. Every time a file is opened, it is recorded, and these records are kept for six years.
• Used for one thing. Your information is used only to prepare your stay safely, and is shared only with the Bwiti Life care team. It is never sold, never used for marketing, and never shared outside the team without your written consent.
• Yours to see, correct or delete. You can ask to see what we hold, correct it, or ask us to delete it once your stay is over. Some records must be kept as long as the medical record-keeping rules that apply to our physician require, and never more than ten years after your last program. The details are in our privacy policy.

Why it matters so much at a retreat

A careful iboga retreat has to ask hard questions, because the answers keep you safe: which substances you use and when you last used them, your psychiatric history and medications, your heart tests, sometimes your trauma. A good screening is detailed. That detail is exactly what makes the file so sensitive.

A card number can be cancelled and a password changed. A diagnosis or a history of addiction, once exposed, cannot be taken back.

What can go wrong without it

Most retreat centers are small, and small teams tend to collect health information with the tools they already have. Each of these is common, and each is a real risk:

• Health questionnaires sent back by email or as an ordinary online form. Copies end up in several inboxes and devices, often unencrypted, kept for years.
• ECGs and lab results traded over personal WhatsApp. They stay in the photo roll of a staff member's phone, and leave with the phone.
• Shared passwords and no record of access. Nobody can say who opened your file, and former staff may still have the password.
• No plan for a breach. If the information leaks, nobody tells you, so you cannot protect yourself.

When this kind of information leaks, the harm is personal and lasting: consequences at work, in a family dispute or with an insurer, and exposure to extortion and fraud. Criminals target medical records precisely because they cannot be changed.

Questions to ask any retreat center

• Where exactly will my health information be stored, and is it encrypted?
• Is your storage provider bound by a Business Associate Agreement, or an equivalent contract?
• Who on your team can open my file, and is every access recorded?
• Will you ask me to send medical documents by email or WhatsApp?
• How long will you keep my information, and can I ask you to delete it?
• What happens, and will you tell me, if my information is ever exposed?

A center that answers clearly has thought about it. A center that shows you a "HIPAA certified" badge instead has not.

Questions people ask

Keep reading

• The programSafety and medical protocolThe risks, the screening, what happens around your mat, and who we decline.11 min read
• Mind and bodyIboga and the heartQT risk, the ECG, electrolytes and how we keep your heart safe, in one place.10 min read
• Mind and bodyCan iboga kill you?What the literature says about deaths, the five causes, and what prevents them.5 min read