HIPAA compliance

Our role

Your pharmacy, practice or health system is the covered entity. We are a business associate, which since the HITECH Act means we are directly liable to the Department of Health and Human Services for the Security Rule, for impermissible use or disclosure, for breach notification to you, for supporting access to a designated record set, for disclosure to the Secretary, and for holding our own subcontractors to the same terms.

The agreement that carries all of that is published in full rather than sent on request, and it is executed before a single event is accepted. Ingestion is inbound only: we write nothing back into a system of record, so removing us changes nothing about how you dispense or document.

Certification

There is no such thing as HIPAA certification. No government body issues one and no private body can confer one, so a vendor advertising itself as HIPAA certified is describing a document that does not exist. What can be said truthfully is that an organisation complies with the Security and Privacy Rules in the role it occupies, and that a reviewer can test any specific control behind that sentence. That is the claim we make, and the rest of this page is the testable part of it.

On the attestation that does exist: SOC 2 Type II controls are documented and the audit has not yet begun. The same statement appears on the security overview, and it will change on both pages on the same day or on neither.

Safeguards

• Tenancy is enforced in the database, not in application code. Row-level security policies scope every tenant-owned table, so a query that forgets the tenant returns nothing rather than everything, and an application bug cannot cross a tenant boundary.
• Events reach us over TLS 1.2 or better, authenticated per location, with credentials you can rotate without contacting us.
• Documents and prescription images are held in encrypted object storage under per-tenant keys, and stored credentials are encrypted with AES-256-GCM under a per-tenant derived key that binds the tenant identity into the ciphertext, so a blob moved between tenants fails to authenticate instead of decrypting.
• Role-based access with least privilege, and time-based two-factor authentication required on every account, including ours.
• Support staff reach a tenant only under a named, time-boxed grant, and the grant appears in that tenant's own log.

The access log

The administrative trail records who changed a record. That is the ordinary control and it answers the second question. The first question in every privacy complaint is who read the patient, so that is recorded separately, in an append-only log the application can write to and cannot edit or delete.

• Refusals are recorded, not only successes. The row is written before the refusal is returned, because a log of permitted reads cannot tell one look from forty attempts.
• Field names, never values. The row records the record, the identifier and which fields were read. A log of PHI reads that quotes the PHI is a second copy of it, usually kept longer than the record itself.
• Break-glass is a first-class outcome. Emergency access requires a written reason, is recorded as break-glass rather than as an ordinary permitted read, and is the first thing a review of the log returns. A system that makes the emergency path invisible teaches people to use it.
• One call decides, records and refuses, so the recording cannot be forgotten.

Your own log is readable by you inside the product.

PHI and logs

Every field that can carry protected health information is declared in a registry, and the registry is deliberately over-inclusive: the cost of marking one field too many is nothing, and the cost of missing one is a disclosure.

A gate in the build reads the source and fails it if a registered field reaches a log statement. It is written as a test rather than a lint rule so it cannot be silenced with an inline comment, and a redactor at runtime is the second line behind it. No PHI is placed in a URL, an error message, an export filename, an email or any analytics call, and no third-party script of any kind loads on a signed-in page.

Minimum necessary

A role is not a scope. Least privilege by role is enforced everywhere, and on top of it sits an attribute layer that decides whether a specific person may reach a specific thing, at a stated sensitivity, for a stated purpose, inside a stated window. It denies by default, an explicit denial outranks any broader grant, the most specific grant wins among grants, and every decision carries the reason it was made.

That layer is enforced on every read of PHI and is being extended endpoint by endpoint. Routing every remaining route through it at once, against scopes no customer has authored yet, would lock customers out of their own data, so it is being adopted deliberately rather than declared complete.

Breach and rights

Notification without unreasonable delay and inside the contractual window, naming what was reached, when, and by whom where that is known, with an incident report you can hand to your own counsel. Component-level service status and incident history are public at status.attergo.com.

For individual rights, we make PHI available to support access, amendment and accounting-of-disclosure requests within the timeframes the Rules require, routed through your account owner. On termination you receive a complete export of your raw archive and every document you uploaded, readable without us. Questions about any of this go to privacy@attergo.com or security@attergo.com.