Skip to main content

Subprocessor list.

Every third party that could touch protected health information on behalf of the plans we administer, published in full, with risk tier and attestation status.

SmartTPA may share Protected Health Information (PHI) with the third parties listed below to operate the platform on behalf of covered entities. A Business Associate Agreement is in place with every subprocessor that handles PHI before any data is exchanged. This page is regenerated each quarter per the SOC 2 CC9.2 / HITRUST 14.b.1 attestation review.

This list is published each quarter. For questions about a specific vendor, contact [email protected].

Schema version 1. The canonical published JSON lives in S3 (Bucket.DOCUMENTS) underpublic/subprocessors-<quarter>.json; this page is rebuilt from that file each quarter.