Patient and member analytics on infrastructure you control.

Chip Hosting Solutions makes no such claim for Marver. Meeting HIPAA's requirements is the work of your organization's program: its risk analysis, policies, access controls and agreements, including the BAA with any cloud provider that hosts Marver. What Marver changes is the architecture. It runs on infrastructure you control, no analytics vendor receives the data it collects, and once a day the Marver server makes a license check carrying a license ID and an install fingerprint, never customer or event data. Marver's own controls, such as three-role access control and an audit trail of configuration and identity changes, are part of what your risk analysis reviews, not a substitute for it.

HHS's FAQ on software vendors says "the mere selling or providing of software to a covered entity does not give rise to a business associate relationship if the vendor does not have access to the protected health information of the covered entity." If Chip Hosting Solutions has no access to your PHI, through support sessions, logs, crash dumps, telemetry or hosting, HHS guidance indicates it is not your business associate. Remote support with access to PHI, or diagnostics uploaded from a system that holds it, would change that. Settle how support will work before any PHI is involved, and have your counsel confirm how the guidance applies to you.

Google Analytics is free on standard properties, and Google's own guidance sets its limits for healthcare. Google says it "does not offer Business Associate Agreements in connection with" Google Analytics, that HIPAA-regulated entities using it must refrain from exposing to Google any data that may be considered PHI, and that customers may only use it on pages that are not HIPAA-covered. It adds that authenticated pages are likely to be HIPAA-covered and should not carry Google Analytics tags. On the HHS side, a federal court vacated the part of HHS's tracking-technology guidance covering IP addresses collected on unauthenticated public health pages; the rest of the guidance, including tracking on patient portals and other logged-in pages, was left in place. Which public pages carry which tags is a decision for your privacy and legal teams.

On infrastructure you control: a Linux host (x86-64 or ARM64) on-prem, or your own cloud account. Analysts reach the data through the desktop Workbench connected to your server. Once a day Marver makes a license check that carries a license ID and an install fingerprint, never customer or event data, and it can go through your HTTP proxy. Air-gapped Enterprise licenses skip it entirely. If the server runs in a cloud account, that provider hosts the data and is your business associate, under your BAA with it.

It can. The FTC's amended Health Breach Notification Rule, effective July 29, 2024, can cover health apps that HIPAA doesn't, and it counts an "unauthorized disclosure" as a breach. Before that amendment, the FTC's first action under the rule, against GoodRx in February 2023, carried a $1.5 million civil penalty over "unauthorized disclosures of consumers' personal health information to Facebook, Google, and other companies." Marver keeps the events it collects on your own server instead of sending them to an analytics vendor. What your app collects and shares, and on what terms, is still for your team and counsel to decide.

Pricing scales with your deployment, not your headcount. Analytics is $2,500 and Analytics + CDP is $5,000, each per month and flat; Enterprise is custom, based on scale. Every tier includes unlimited users, and the 45-day trial is free. Joining portal, call-center and other offline records into one profile per patient or member needs Analytics + CDP; running fully offline on an air-gapped network needs Enterprise.