Compliance

HIPAA Notice

No BAA required. Mungr never receives, stores, or processes Protected Health Information.

Important clarification

Mungr is not a HIPAA covered entity or business associate. We do not receive, store, transmit, or process Protected Health Information (PHI).

How Mungr helps maintain HIPAA compliance

  • All data processing occurs locally in the user's browser via WebAssembly
  • No PHI is transmitted to Mungr's servers at any time
  • No data upload endpoints exist on our infrastructure
  • Users can verify this by inspecting browser network traffic during use

What this means for covered entities

  • No Business Associate Agreement (BAA) is required because Mungr never accesses PHI
  • The HIPAA Security Rule's transmission safeguards are satisfied by design. There is no transmission
  • Minimum Necessary standard is inherently met. We have access to zero patient data

User responsibilities

  • Users remain responsible for securing their local computing environment
  • Users should follow their organization's policies regarding PHI handling
  • While Mungr doesn't transmit data, users should ensure their browser session is on a secure, authorized device

Recipe sharing

  • Shared recipes contain ONLY transformation logic (step definitions as JSON)
  • Zero data values from processed files are included in recipes

Recipe example

Below is a real Mungr recipe. It masks two PHI columns, cleans names and dates, trims fields, and corrects a state code. Only transformation logic is stored in the JSON — zero data values.

{
  "name": "Patient export cleanup",
  "steps": [
    { "type": "mask_pii", "column": "national_id", "mode": "mask", "piiType": "ssn" },
    { "type": "mask_pii", "column": "phone", "mode": "mask", "piiType": "phone" },
    { "type": "change_case", "column": "first_name", "case": "title" },
    { "type": "change_case", "column": "last_name", "case": "title" },
    { "type": "standardize_dates", "column": "dob", "outputFormat": "%Y-%m-%d" },
    { "type": "standardize_dates", "column": "admission_date", "outputFormat": "%Y-%m-%d" },
    { "type": "correct_values", "column": "state", "corrections": { "VIC": "VI" } },
    { "type": "trim", "column": "patient_id" }
  ]
}

Share the recipe as JSON or export it as Python, DuckDB SQL, or a shell script — the recipe travels, the data never has to.

Audit trail

Enterprise plans include audit logs showing who created/modified recipes (no data content logged).

Questions

Contact hello@getmungr.com