Subprocessor list.

Every third party that could touch protected health information on behalf of the plans we administer — published in full, with risk tier and attestation status.

Initial publication pending the first quarterly run of the publish_subprocessor_list task.

SmartTPA may share Protected Health Information (PHI) with the third parties listed below to operate the platform on behalf of covered entities. A Business Associate Agreement is in place with every subprocessor that handles PHI before any data is exchanged. This page is regenerated each quarter per the SOC 2 CC9.2 / HITRUST 14.b.1 attestation review.

No subprocessors are currently published. The list is regenerated quarterly; check back after the next publication.

Schema version 1. The canonical published JSON lives in S3 (Bucket.DOCUMENTS) underpublic/subprocessors-<quarter>.json; this page is rebuilt from that file each quarter.