Transparency on every item — what's live, what's in progress, and what we're scheduled to deliver. Updated quarterly.
The 14 controls on our HIPAA Compliance Checklist, with current status. We don’t mark anything “live” until it actually is.
Formal SRA underway with our compliance counsel. Findings will inform our final policy set and Practice-tier launch checklist.
Drafting the full HIPAA policy set: access control, sanctions, workstation use, device/media, contingency, and more. Targeting completion ahead of BAA launch.
Template drafted and queued for outside-counsel review. BAAs will be available to Practice-tier customers at launch.
Hosting provider BAA in active negotiation. Email and backup subprocessor BAAs follow on the same Q3 2026 timeline.
Annual HIPAA training program selected. All workforce members will complete training before any PHI is handled under a customer BAA.
Quotes secured. Policy will be bound and in force before the first customer BAA is signed.
Postgres storage-layer encryption is enabled today. Document blobs are stored in encrypted object storage with US-region pinning.
TLS 1.3 only, HSTS preloaded, no clear-text protocols anywhere in the document path. Verified via external scanners.
Signing audit trails are live on every envelope; application logs flow to journald with retention. Wazuh-equivalent SIEM hardening is scheduled for Q3 2026.
Admin sign-in is currently magic-link based. TOTP-based MFA enforcement for all admin and operator accounts is scheduled for Q2 2026.
Detection, triage, containment, and notification workflows are drafted. Final tabletop exercise and sign-off scheduled before BAA launch.
Drafted to align with the HIPAA Breach Notification Rule (72-hour notice where required) and applicable state data-breach laws.
Daily encrypted backups are operational today. Full DR runbook with documented RTO/RPO targets is on track for Q3 2026.
Admin and superadmin roles are enforced in code. Per-account isolation prevents cross-tenant document access by default.
If you’re evaluating us for a HIPAA-covered workflow, here’s the truth: we are not BAA-ready today. The Practice tier — which includes the HIPAA BAA — is on track for Q3 2026 launch. If you sign up for Practice now, you join the BAA waitlist with locked-in early-access pricing.
Email [email protected] — we respond within one business day.
Email Security