Trunk does not take patient data, so HIPAA does not apply

Decision

• Trunk is not built for health data. The terms forbid capturing real patient data (PHI) or other special-category data. A product behind a sign-in is captured with a test account holding made-up data.
• No BAAs. Trunk signs no HIPAA business associate agreement, and none of its providers is chosen for one.
• SOC 2 is the target instead, when a buyer asks for it. What it needs is compliance.

Why

• Trunk stores what it captures: page HTML and screenshots. A capture signed in as a real user of a clinic's app would store that user's records. Holding PHI makes Trunk a business associate, with BAAs to sign with every customer and every provider behind it, and few of the free or cheap plans Trunk runs on offer one.
• A design tool needs the shape of a page, not the people in it. Test accounts give the same pages.
• The owner asked on 2026-10-21 whether Trunk is HIPAA or SOC 2 compliant. It is neither; this decides that HIPAA is not a goal.

Impact

• Terms gain a line forbidding real patient data; Privacy says captures should use test accounts. terms, privacy.
• The Capture step already asks for a role's test email and password (capture-reads-the-product). Its copy stays.
• Selling to healthcare later means a new decision that supersedes this one, and providers that sign BAAs.

Status

Draft — waiting for the owner.

Sources

• The owner's question in the session of 2026-10-21.