Utilitly – PHI and Document Processing

1. Introduction to HIPAA

The Health Insurance Portability and Accountability Act (HIPAA) sets the standard for sensitive patient data protection. Companies that deal with protected health information (PHI) must have physical, network, and process security measures in place.

2. Utilitly.com does not hold a BAA

Stating the important part first: Utilitly.com has not executed a Business Associate Agreement with you and is not a HIPAA-certified service. Nothing on this page should be read as approval to process protected health information. What we can tell you precisely is where your file goes, so that your own compliance assessment has accurate facts to work from.

Tools that never transmit your document

Twenty-two of our 26 tools run entirely inside your web browser: Merge, Split, Rotate, Reorder Pages, Delete Pages, PDF to Image, Image to PDF, Extract Images, Annotate, Watermark PDF, Add Page Numbers, PDF Text Extractor, True Text Editor, AI Author, Sign PDF, Protect PDF, Unlock PDF, and the five image tools. With these, the file is read from your device and processed on your own hardware — it is not uploaded to us or to anyone else. You can confirm this yourself in your browser's DevTools Network tab. Because no disclosure to a third party occurs, these tools function as local software rather than as a service handling your data.

Protect PDF and Unlock PDF moved into this group in August 2026. Until then both sent the document and the password you typed to an external service, and earlier versions of this page said so. They now run qpdf compiled to WebAssembly inside your browser: the AES-256 encryption happens on your own machine, and the password is never transmitted. Automated tests run both tools with the network disconnected and assert that no request leaves our own domain.

3. Tools that send your file to an external service

Four tools cannot be performed in a browser and transmit your file over an encrypted HTTPS connection to a third-party processing service, which converts or compresses it and returns the result:

Compress PDF
PDF to Office (Word, Excel, PowerPoint, CSV)
Office to PDF
Advanced OCR Scanner

Encryption protects these files in transit. It does not change the fact that the document is disclosed to an additional party, and we do not publish verified retention, logging, or training terms for that processing service.

Our advice, plainly: do not put protected health information through those four tools. If you need to work on PHI, use the in-browser tools listed in section 2, or software running on hardware your organisation controls. Treat the four above as suitable only for de-identified or non-sensitive administrative documents, and only after your own review.

4. Access Controls

Your Utilitly.com account (which manages billing and tier access) is secured via Clerk, an enterprise-grade authentication provider featuring robust password hashing, brute-force protection, and optional multi-factor authentication (MFA).

5. Contact Information

If your hospital, clinic, or healthcare organization requires further technical details regarding our local processing architecture, please reach out to our security team:

Email: privacy@utilitly.com

Please include "HIPAA Inquiry" in the subject line.