HIPAA compliance

• Encrypted in transit. Every page, API and signalling connection uses TLS 1.2 or later. WebRTC audio and video are always encrypted with DTLS-SRTP. One-to-one calls are encrypted end to end between the two devices, and relay (TURN) servers only pass on packets they cannot read.
• Encrypted at rest. Databases, files and backups that hold PHI are encrypted with AES-256. Visit notes, chat and transcripts are also encrypted by the application itself before they are saved.
• A signed BAA. We sign one before we create, receive, store or transmit PHI for you, and we only bring in subcontractors and cloud services that sign one too.
• No certificate exists. The U.S. Department of Health and Human Services does not certify HIPAA compliance, so a “HIPAA certified” badge means nothing. What counts is the safeguards, the agreements and the records that show them, and we give you all three.

For each safeguard in 45 CFR §164.312, this is what we build in:

• Access control: a unique account for every user, role-based permissions, automatic logoff of idle sessions, an emergency access procedure, and encryption of stored PHI.
• Audit controls: a log of who opened, created, changed or exported PHI and when, kept append-only and apart from application logs.
• Integrity: authenticated encryption (AES-GCM), so changed or damaged records are detected, plus backups we restore on a schedule to prove they work.
• Person or entity authentication: multi-factor sign-in for clinicians and staff, and signed, expiring links for patients joining a visit.
• Transmission security: TLS everywhere with HSTS, DTLS-SRTP for media, and no PHI in URLs, e-mail subjects or push notifications.

PHI also stays out of analytics, error tracking and logs, and there is no third-party tracking on screens where patients enter or view health information.

One-to-one visits can run peer to peer, encrypted end to end. Group sessions use a media server (SFU): media is encrypted on every hop and decrypted only on a server you control, and where a product needs true end-to-end encryption for groups we add it with insertable streams, which rules out server-side recording.

Recording and transcription happen only with consent, are stored encrypted, and only go through a service covered by a BAA or one running on your own servers. Never through a browser’s cloud speech service.

We deploy on HIPAA-eligible services from AWS, Microsoft Azure or Google Cloud under your BAA with that provider, or on your own servers. We set up encrypted volumes and backups, private networks, least-privilege access and log retention, and we document all of it for your risk analysis.

The BAA sets out what we may do with PHI, the safeguards we keep, how our subcontractors are bound, and how we return or destroy PHI when the work ends. If a breach happens we report it to you without unreasonable delay, and no later than the 60 days HIPAA allows. We can sign your BAA or send ours.

Where the work only needs test data, we build and test with synthetic records and never see real PHI.

HIPAA applies to your whole organisation, not only to the software. Your risk analysis, policies, workforce training, Notice of Privacy Practices, patient-rights requests and BAAs with your other vendors stay with you. We supply the technical documentation those need. Take legal advice on the rules that apply to you.

Under the GDPR and UK GDPR, health data is a special category of personal data. The same safeguards apply, we sign a data processing agreement, and we host in the region your patients’ data has to stay in.

The demo call and our booked meetings are sales tools, not clinical systems, so please don’t share patient information on them. They follow the same approach: calls are one to one and encrypted end to end, links are signed and expire, saved meeting notes are encrypted with AES-256-GCM before they are stored, every opening of a meeting is written to an access log, and the call and meeting pages carry no analytics. Live captions use your browser’s speech recognition, which the browser maker may process: on a demo call they run only while you switch them on, and on a booked meeting they are part of the notes, which the join screen says before you enter. Details are in our Privacy Policy.

E-mail daniollc7@gmail.com or send us your requirements. If you are planning a telemedicine product, see healthcare software development.