§ Standards of practice

Compliance, quietly continuous.

We keep the credentials current, the controls live, and the audit trail queryable — so your team can build the brand, not the paperwork.

HIPAA · current BAA · one-click record

The registry — three standards, all maintained inside the platform.

Each standard below is enforced inside the platform, not parked in a binder that goes stale.

i.
HIPAAU.S. Privacy & Security Rules
Administrative, physical, and technical safeguards implemented at every node. Continuous risk analysis, workforce training, granular information-access management.
Current Reviewed quarterly
ii.
AES-256 / TLS 1.3Cryptographic standards
At rest and in transit. End-to-end encrypted telehealth sessions. Hardware key rotation on a published schedule.
Enforced Key rotation logged
iii.
BAABusiness Associate Agreement
Active business associate agreements for all enterprise vendors, signed and version-controlled in the platform itself.
All vendors current One-click record
§ Access control

Every person sees only what their role needs to.

HIPAA's minimum-necessary standard is not a binder — it is enforced in the platform. Access is role-based and scoped to the data each job actually requires. Providers see the patients assigned to them. Support sees contact and order status, never clinical notes. Operators see aggregates, not protected health information in the clear. Every view is logged.

Access control · role-based Least privilege
Provider networkAssigned patients · full chart · prescribing
Clinical
Support agentContact + order status · no clinical notes
Limited
Operator / growthCohorts + ops metrics · no PHI in the clear
De-identified
FinanceBilling + payments · no clinical data
Billing only
EngineeringNo production PHI by default · break-glass access logged
None
§ Safeguards

Three layers, none of them optional.

i.

Administrative — people & policy.

Continuous risk analysis, rigorous workforce training, granular information-access management. The work no audit firm gets to skip.

  • Periodic internal audits
  • Background-checked staff
  • Documented incident response plan
  • Annual workforce HIPAA training
ii.

Physical — the hardware & the room.

Securing the actual hardware and facilities. Facility access controls, encrypted workstation security modules, hardware inventory tracked in the same ledger as the chart.

  • Facility access logs
  • Encrypted workstation modules
  • Secure document disposal
  • Hardware inventory control
iii.

Technical — the bytes themselves.

Access controls, automated audit logs, integrity checks at every layer. AES-256 at rest, TLS 1.3 in transit, unique user identification, automatic log-off.

  • AES-256 / TLS 1.3
  • Unique user identification
  • Automatic log-off policies
  • Immutable audit trail

The questions buyers actually ask.

A partial table of standing answers. Full policy documents and BAA template furnished on request.

Where is PHI stored?
US-East-1 and US-West-2, in segmented VPCs with no public ingress. Encrypted at rest with AES-256. Backups encrypted, geo-replicated, retention configurable per program.
§ 1.04Storage
Who can access a chart?
Role-based access tied to organizational unit. Every read is audit-logged with user, time, IP, session. The audit feed is queryable; access reviews run quarterly.
§ 2.01Access
How long do you retain records?
Clinical records: 7 years, configurable up to the maximum required by state. Audit logs: 7 years immutable, cryptographically signed. Patient-initiated erasure honored within 30 days.
§ 3.02Retention
What happens during an incident?
Documented playbook: detect → contain → forensics → notify → remediate. Customer notification within 24 hours of confirmed material incident; regulator notification per HIPAA / state law.
§ 4.01Incident
Do you sign BAAs?
Yes. Standard BAA available for review before contract. All enterprise sub-processors hold current BAAs with us, version-controlled inside the platform.
§ 5.01BAA
Can patient data be fully deleted?
Yes. Patient deletion requests are honored end-to-end. Identifying data is removed from production within 30 days; redacted record retained for legal hold where required, never accessible to operators.
§ 6.01Deletion
§ Begin

Bring your security team.

Most security teams find out what they want to ask only after seeing the console.
Bring them. We have time.

Talk with Remedora → Read the platform