Built for HIPAA from day one
HIPAA compliance is not bolted on to Orisan Connect -- it is architected into every layer of the platform. From encrypted storage and immutable audit logs to tenant-isolated databases and automated PHI redaction, security is a foundation, not a feature.
Business Associate Agreements
Every customer gets a signed BAA
Our Business Associate Agreement covers all data processing through Orisan Connect, including the sync pipeline, audit logging, credential storage, and monitoring infrastructure. We execute BAAs with every customer before any PHI enters the platform.
- BAA covers the full data lifecycle -- ingestion, transformation, storage, and deletion
- Includes sync pipeline, audit logging, credential vault, and monitoring
- Enterprise customers can request custom BAA review for specific legal requirements
BAA Coverage Scope
HIPAA Security Rule
The three pillars of HIPAA safeguards
The HIPAA Security Rule requires administrative, physical, and technical safeguards to protect electronic PHI. Here is how Orisan Connect addresses each category.
Administrative Safeguards
Policies, procedures, and workforce management
Security Management
Documented security policies and regular risk assessments govern how PHI is handled across the platform. Security scanning via Sobelow is integrated into our CI pipeline.
Workforce Security
Role-based access control (RBAC) enforced per tenant. Every user action within Orisan Connect is scoped to their organization and role, preventing unauthorized access to PHI.
Access Management
Per-schema PostgreSQL multi-tenancy isolates each customer's data at the database level. No tenant can access another tenant's records, even in the event of an application-level bug.
Security Awareness
All team members receive training on PHI handling procedures. Codebase rules enforce PHI protections automatically, and compliance reviewers audit code changes before deployment.
Incident Response
Documented breach notification procedures with immediate internal investigation upon discovery. Written notification to affected customers within 60 days per the HIPAA Breach Notification Rule.
Contingency Planning
Automated backups via AWS RDS with point-in-time recovery. Infrastructure defined as code via Terraform ensures reproducible environments and disaster recovery readiness.
Physical Safeguards
Facility access and workstation security
AWS Infrastructure
All infrastructure runs on AWS, which maintains SOC 2 Type II, ISO 27001, and HIPAA certifications. AWS manages physical facility security, including 24/7 monitoring, biometric access controls, and environmental protections.
Serverless Compute
Orisan Connect runs on AWS ECS Fargate -- serverless container infrastructure with no persistent hosts. There are no physical servers to access, patch, or decommission. Containers are ephemeral and replaced on every deployment.
Fully Cloud-Native
No on-premises servers, no co-located hardware, no physical media to manage. Database backups, encryption keys, and secrets are all managed through AWS-native services covered under our BAA.
Technical Safeguards
Technology-based protections for electronic PHI
Access Controls
- Unique user identification via UUIDs for all accounts
- Role-based access control (RBAC) scoped per tenant organization
- Session-based authentication with Argon2 password hashing
- Automatic session timeout after period of inactivity
- LiveView on_mount hooks enforce authentication on every connected page
Audit Controls
- Immutable, append-only audit log for every PHI read and write operation
- Every entry records: timestamp, actor, action, resource type, and resource ID
- No PHI values stored in audit entries -- only identifiers and field names
- Bulk sync operations produce per-record audit entries for full traceability
- Audit logging via ConnectCore.Audit with isolation and retention controls
Integrity Controls
- Conflict detection engine classifies data conflicts for automatic or manual resolution
- Keyed HMAC-SHA256 content hashing for incremental change detection during sync
- Ecto changeset validation enforced at every data boundary
- Vendor API responses validated against expected schemas before processing
Transmission Security
- TLS 1.3 enforced via ELBSecurityPolicy-TLS13-1-2-2021-06 load balancer policy
- HTTPS-only with HTTP Strict Transport Security (HSTS) headers
- All vendor EHR/PM API calls use TLS 1.2+ with certificate validation enabled
- Certificate verification is never disabled -- enforced in codebase rules
Encryption at Rest
AES-256-GCM column-level encryption via cloak_ecto. PHI columns use the _encrypted suffix convention. Encryption keys managed through AWS Secrets Manager.
Credential Encryption
Vendor OAuth tokens and API keys stored using envelope encryption in the credential vault. Token refresh happens proactively before expiry. No hardcoded credentials anywhere.
Storage Encryption
S3 objects encrypted with AWS KMS. RDS instances use encrypted storage volumes. Redis in-transit encryption enabled for rate limiter and job queue data.
PHI Handling
Enforced in code, not just in policy
These PHI protections are enforced through codebase rules, automated compliance checks, and architectural constraints -- not just written policies.
No PHI in Logs
PHI is never logged in plaintext. The Compliance.Redactor module scrubs structs before any Logger call, telemetry event, or error message output.
No PHI in Browser
PHI is never stored in localStorage, sessionStorage, or cookies. LiveView templates never expose PHI via phx-value-* HTML attributes. JS hooks cannot access PHI.
Safe Notifications
Notifications contain event summaries only -- record counts, entity types, and vendor names. Never patient identifiers. PubSub is ephemeral; PostgreSQL is the source of truth.
Safe Job Arguments
Oban background job arguments must not contain PHI, as they are stored unencrypted in the job queue. Jobs reference records by opaque UUID only.
Encrypted Storage
All PHI database columns use column-level encryption with the _encrypted suffix convention. Redis keys for PHI use opaque identifiers, never patient names.
Temporary File Cleanup
Any temporary files containing PHI are cleaned up immediately after use. No PHI persists in transient storage or file caches beyond the operation that created it.
At a Glance
HIPAA requirements mapped to our implementation
| HIPAA Requirement | Orisan Connect Implementation |
|---|---|
| Access Control | UUID-based user IDs, RBAC, Argon2 auth, session timeout, LiveView on_mount hooks |
| Audit Logging | Immutable append-only log via ConnectCore.Audit, per-record entries, no PHI in log values |
| Encryption at Rest | AES-256-GCM via cloak_ecto, _encrypted column convention, KMS for S3 |
| Encryption in Transit | TLS 1.3 (ELBSecurityPolicy-TLS13-1-2-2021-06), HSTS, vendor calls TLS 1.2+ |
| Data Integrity | Keyed HMAC-SHA256 change detection, conflict resolution engine, Ecto changeset validation |
| Tenant Isolation | Per-schema PostgreSQL multi-tenancy, data isolated at database level |
| Credential Security | Envelope encryption, AWS Secrets Manager, proactive token refresh, no hardcoded secrets |
| PHI Logging Prevention | Compliance.Redactor module, no PHI in Logger/telemetry/exceptions/Oban args |
| Physical Safeguards | AWS SOC 2/ISO 27001 facilities, ECS Fargate serverless, no on-prem infrastructure |
| Breach Notification | Within 60 days per HIPAA Breach Notification Rule, immediate internal investigation |
Subprocessor Transparency
You know exactly who handles your data
We maintain a transparent list of subprocessors involved in operating Orisan Connect. Each subprocessor's role and PHI exposure level is documented so you can make informed decisions about your data.
Amazon Web Services
BAA CoveredInfrastructure provider. Hosts compute (ECS Fargate), database (RDS PostgreSQL), secrets (Secrets Manager), and object storage (S3). All services operate under a signed BAA.
Resend
No PHITransactional email delivery. Emails sent through Resend contain no PHI -- only account notifications, system alerts, and operational messages.
Vendor EHR/PM APIs
Your Existing BAAAdvancedMD, Tebra, athenahealth, and other EHR/PM systems. Your existing Business Associate Agreement with each vendor governs that relationship. Orisan Connect acts as your authorized agent.
Breach Notification
Committed to transparency if the worst happens
In the event of a security incident involving PHI, we follow the HIPAA Breach Notification Rule with a clear, documented process.
Immediate Investigation
Upon discovery of a potential breach, our security team initiates an immediate internal investigation to determine scope and impact.
Containment & Remediation
The breach vector is contained, affected systems are secured, and remediation steps are executed to prevent recurrence.
Written Notification
Affected customers receive written notification within 60 days, including details of the breach, data involved, and steps taken.
Ready to get started?
Request a BAA and see how Orisan Connect protects your patients' data while keeping your clinical systems in sync.