Healthcare.
PHI that never comes to rest.

A patient summary is protected health information from the first line to the last. Any service that renders it and then stores it has become a place where PHI lives, with everything that follows from that.

Get API keyRead the quickstart

The documents

  • Patient summariesVisit notes, medication lists and results, shared with the patient or a colleague.
  • Billing statementsWhat was billed, what insurance covered, what the patient owes.
  • Referral lettersStructured letters to another provider, usually generated from a template.
  • Lab and imaging reportsResults formatted for printing or for a portal download.
  • Consent and intake formsProduced filled in, ready to sign.

Where PHI accumulates

Most breaches of health data are not clever attacks on the clinical system. They are a misconfigured bucket, an old backup or a vendor that kept more than anyone remembered. Each of those requires the data to have been stored somewhere. A renderer that never writes the document to disk cannot leak it later, and does not appear on the list of places to check.

HIPAA and business associates

Under HIPAA, a vendor that creates, receives, maintains or transmits PHI on your behalf is a business associate and needs an agreement. Transmission still counts, so the agreement is still required: what changes is the risk behind it. There is no maintained copy, so there is nothing for a breach of ours to expose, and the Security Rule safeguards around stored PHI have nothing to apply to. Talk to us before you go live with PHI so the paperwork is in place.

What a request looks like

summary.json
{
  "html": "<article class=\"summary\">…patient summary rendered by your own templates…</article>",
  "options": {
    "format": "Letter",
    "margin": { "top": "2cm", "bottom": "2cm" },
    "printBackground": true
  },
  "responseFormat": "binary"
}

Healthcare: common questions

Is html4pdf HIPAA compliant?

Compliance is a property of how a system is operated, not a badge a product carries. What we can say precisely: documents are rendered in memory and never written to disk or stored, and logs contain no document content. If you are putting PHI through it, contact us about a business associate agreement before you go live.

Do you sign a BAA?

Get in touch at the support address and we will walk through it with you. The conversation is short, because there is no stored PHI to write safeguards around.

Is the PHI encrypted in transit?

Yes. All requests are over HTTPS. There is no encryption at rest to discuss, because there is no data at rest.

What appears in your logs?

That a request happened, which key it used, the credit it consumed and how long it took. Never the markup, never the output, never a patient identifier unless you put one in a field we do not read.

Can patients download these documents?

You receive the bytes and serve them from your own portal, under your own authentication. There is no link on our side to leak or guess.

Other teams using it