Bereavement mailings involve protected health information. We treat it that way, from the day you add a family until well after the last letter.
Every hospice signs our BAA in the portal before adding a family. Our print and mail partner signs one with us.
Each family's details are encrypted at rest with AES-256-GCM and only decrypted in memory to print a letter or show it to your team. All traffic uses HTTPS.
We record who viewed or changed each family, and when. Your team signs in with a one-time email link, so there are no shared passwords.
We ask only for what the letters need: names, a mailing address, the date of death and, optionally, a birthday. No diagnoses, no medical records.
Printer files are deleted within two days. Family details are removed 180 days after the series ends, leaving only the dates of each contact for your records.
Emails to your team never include family details; they simply ask you to sign in. Envelopes show only the family's address and your return address.
Heartwood acts as a business associate of your hospice under HIPAA. Our Business Associate Agreement describes our obligations, including safeguards, breach notification, subcontractor agreements and the return or destruction of information at the end of our relationship.
Family information is used only to produce and mail your bereavement letters and to show your team their program. It is never sold, never used for marketing, and never shared except with our print and mail partner, which is bound by its own BAA.
Questions about security, or need a completed vendor questionnaire? Write to hello@heartwoodletters.com. We're glad to help.
Add your first ten families at no cost. If it isn't right for your hospice, you've lost nothing.
Heartwood Letters