HIPAA Compliance
Enterprise-grade security for healthcare data
BoostCliniq AI is fully HIPAA compliant and operates as both a HIPAA-covered entity and Business Associate. We implement comprehensive security measures and maintain strict data protection protocols in accordance with the Health Insurance Portability and Accountability Act (HIPAA) and the Health Information Technology for Economic and Clinical Health (HITECH) Act.
All Protected Health Information (PHI) is handled with the highest level of security and confidentiality. We provide Business Associate Agreements (BAAs) to covered entities using our Platform.
HIPAA Compliance Overview
HIPAA Privacy Rule
- •Limits use and disclosure of PHI
- •Patient access to medical records
- •Amendment and accounting of disclosures
- •Patient privacy rights protection
HIPAA Security Rule
- •Administrative safeguards
- •Physical safeguards
- •Technical safeguards
- •Encryption and access controls
Breach Notification Rule
- •60-day breach notification requirements
- •Incident response procedures
- •HHS notification process
- •Individual notification protocols
HITECH Act
- •Enhanced privacy protections
- •Genetic information safeguards
- •Data breach penalties and enforcement
- •Audit and compliance controls
Our Security Measures
Administrative Safeguards
- Access Controls: Role-based access control (RBAC) ensures users can only access authorized data
- Authentication: Multi-factor authentication (MFA) for all user accounts
- Workforce Security: Strict policies for employee access and data handling
- HIPAA Training: Regular compliance training for all staff members
- Security Awareness: Continuous monitoring and awareness programs
Physical Safeguards
- Data Center Security: HIPAA-compliant data centers with 24/7 monitoring and restricted access
- Environmental Controls: Temperature, humidity, and fire suppression systems
- Access Logging: All physical access is logged and monitored
Technical Safeguards
- Encryption in Transit: TLS 1.3 encryption for all data transmitted
- Encryption at Rest: AES-256 encryption for all stored data
- Audit Logs: Comprehensive logging of all system access and activities
- Firewall & Intrusion Detection: Enterprise-grade protection systems
- Data Integrity: Checksums and hashing to detect data tampering
Certifications & Audits
HIPAA Compliant
Full HIPAA compliance certified. We undergo regular audits to ensure continued adherence to all HIPAA requirements.
SOC 2 Type II
Independent third-party audits verify our security controls meet SOC 2 Type II standards.
Regular Security Audits
Quarterly security assessments and annual penetration testing by third-party security firms.
Business Associate Agreements
All covered entities receive executed BAAs outlining data handling responsibilities and security obligations.
Data Handling & Retention
PHI Collection
We collect and process only the minimum necessary Protected Health Information required to provide healthcare services. Patient data is collected with appropriate consent and for legitimate healthcare purposes.
Data Retention
In accordance with HIPAA regulations and common healthcare practices, we retain Protected Health Information for:
- • Minimum 6 years: Required under HIPAA for audit purposes
- • Patient request: Longer retention when requested by patients or required by state law
- • Legal hold: Extended retention during litigation or investigations
- • Secure deletion: Data is securely destroyed after retention period using certified methods
Data Access & Disclosure
We follow strict protocols for data access and disclosure:
- • Data is shared only with authorized personnel with valid business need
- • All disclosures are logged and auditable
- • Patient consent is obtained for any non-healthcare disclosures
- • Third-party vendors execute BAAs before accessing any PHI
Breach Response & Notification
Our Commitment
In the event of a suspected data breach, we immediately initiate our comprehensive breach response protocol to protect affected individuals and comply with all regulatory requirements.
Immediate Response
Upon detection of a breach, we immediately assess the scope and stop the unauthorized access.
Investigation
We conduct a thorough investigation to determine what data was accessed and by whom.
Risk Assessment
We assess the risk of identity theft or fraud based on the nature and scope of the breach.
Notification
Within 60 days, we notify affected individuals, the HIPAA Office of the Secretary, and media if required.
Remediation
We implement corrective measures to prevent similar breaches in the future.
Covered Entity Responsibilities
As a Business Associate, we provide the technical and organizational infrastructure for HIPAA compliance. However, covered entities retain primary responsibility for:
- Ensuring workforce members receive proper HIPAA training
- Implementing administrative and physical access controls
- Maintaining business processes compliant with HIPAA
- Verifying appropriate use of the Platform
- Monitoring for unauthorized access to PHI
- Maintaining contingency and disaster recovery plans
- Executing Business Associate Agreements with all vendors
- Responding to patient requests for access to medical records