Compliance overview
HIPAA compliance is not a feature added to the platform. It is a requirement embedded in every layer, from infrastructure provisioning to application code, from employee onboarding to incident response. The controls described on this page represent our documented security posture as of October 2026. Confirm current vendor agreements and controls before relying on this page for procurement.
HaloPT acts as a business associate when it processes protected health information for a covered-entity customer. We execute a Business Associate Agreement before that customer sends live PHI. The compliance program is designed to support customers in meeting their obligations under the Privacy Rule, Security Rule, and Breach Notification Rule.
This page describes technical and organizational measures. For the full description of data handling practices, see the Privacy Policy. For the terms governing our role as a business associate, see the Terms of Service.
Security measures
The controls below are the technical safeguards in place to protect PHI at every stage of its lifecycle.
Encryption in transit
TLS 1.3Data in transit uses TLS. That covers API requests, uploads, and audio sent to the API. We do not publish an SSL Labs badge as a claim.
Encryption at rest
AES-256Production application data sits on Cloud SQL for PostgreSQL, encrypted at rest, in the same Google Cloud project as Cloud Run. A pre-cutover Neon copy is retained separately. We do not issue a unique data-encryption key per tenant.
Access controls
RBACRole-based access scopes therapists, patients, desk, caretakers, and referring physicians. MFA is not a required login step on every account today.
Audit logging
ImmutableActions write to an audit log with user, organization, and time. We do not claim six-year cryptographic retention or a customer SIEM feed.
Tenant isolation
Row-levelEach organization operates within a logically isolated tenant. Data is scoped at the organization level through enforced row-level security in PostgreSQL. Cross-tenant access is prevented at the application and database layers.
Breach notification
≤ 60 daysIn the event of a confirmed breach of unsecured PHI, affected customers are notified without unreasonable delay and no later than 60 days from discovery, as required by the HIPAA Breach Notification Rule. The notification covers the nature of the breach, categories of affected individuals, likely consequences, and remediation taken.
How HIPAA requirements are met
The HIPAA Security Rule requires three categories of safeguards. Below is how HaloPT addresses each.
Administrative safeguards
Security officer designation
A designated Privacy Officer and Security Officer are responsible for implementing and overseeing the HIPAA program. Both report directly to executive leadership.
Workforce training
Production access is limited. We do not publish an annual training or background-check program as a certification.
Risk assessment
Risk assessments are conducted at least annually and whenever significant infrastructure or application changes occur. Findings are tracked to remediation and reviewed by leadership.
Contingency planning
Production Postgres uses Cloud SQL automated backups. A pre-cutover Neon copy is retained separately. We do not publish a quarterly DR test or named RTO/RPO.
Physical safeguards
Facility access controls
Compute runs on Google Cloud Run. Production Postgres is Cloud SQL in the same project. Google publishes its own SOC 2 reports. HaloPT does not have a SOC 2 Type 1 or Type 2 report.
Workstation security
PHI is not the local working copy. We do not run an MDM or remote-wipe program as a published control.
Device controls
Personal devices are prohibited from accessing production. Company-issued devices are inventoried, encrypted, and remote-wiped on separation.
Technical safeguards
Access controls
Unique user IDs, emergency access procedures, automatic logoff after 30 minutes of inactivity, and session-token rotation every 24 hours control access to ePHI.
Audit controls
Hardware, software, and procedural mechanisms record activity in systems containing PHI. Every access event is correlated with user identity, IP, and timestamp.
Integrity controls
Chart writes are logged. We do not claim cryptographic checksums on every document.
Transmission security
TLS 1.3 is enforced at every network boundary. Internal service-to-service communication uses mutual TLS.
Business Associate Agreement
Every customer that qualifies as a covered entity under HIPAA receives a Business Associate Agreement. The BAA is signed before live PHI. Seats are Practice, Practice Pro, and an Insurance bolt-on — not Starter, Growth, or Enterprise.
What the BAA covers
- Permitted uses and disclosures of PHI by HaloPT as a business associate
- Obligation to implement appropriate safeguards per the HIPAA Security Rule
- Requirement to report breaches of unsecured PHI to the covered entity
- Obligation to ensure subcontractors who handle PHI sign BAAs
- Patient rights to access, amendment, and accounting of disclosures
- Return or destruction of PHI upon termination of the agreement
- Authorization for the Secretary of HHS to audit HaloPT for compliance
Review the complete BAA framework at /baa.
Audit logging
Every action within the platform is logged. Logging is not selective. Authentication events, data access, record modifications, file downloads, message sends, and administrative configuration changes are all written to the audit trail.
Each audit record contains
USER
Authenticated user ID and role
ORGANIZATION
Tenant context
IP ADDRESS
Source IP of the request
TIMESTAMP
ISO 8601 UTC
ACTION
Create, read, update, delete
RESOURCE
Entity type and identifier
OUTCOME
Success, failure, denied
USER AGENT
Client application detail
Administrators can see activity in the product. We do not publish a six-year retention, JSON/CSV export, or SIEM forward as a current feature.
Patient rights under HIPAA
The HIPAA Privacy Rule grants patients specific rights regarding their PHI. The platform provides tools that enable covered entity customers to fulfill those obligations within the timelines required.
Right of access
Patients may inspect and obtain a copy of their PHI. The platform supports the 30-day response window required by HIPAA, with one 30-day extension on written notice.
Right to amendment
Patients may request amendments when records are inaccurate or incomplete. The platform tracks requests, manages the 60-day timeline, and preserves the original record.
Accounting of disclosures
HIPAA gives patients an accounting of certain disclosures. The covered entity remains responsible for that response.
Restriction requests
Patients may request restrictions on uses or disclosures for treatment, payment, or operations. The platform supports configurable record- or field‑level restrictions.
Confidential communications
Patients may request alternative means or locations for communication. Notification preferences and channel routing are configurable per patient.
Notice of privacy practices
The platform supports distribution and acknowledgment tracking of the covered entity’s Notice of Privacy Practices through onboarding workflows.
Breach notification
If a breach of unsecured PHI occurs, the platform follows a documented incident response process that ensures timely notification to affected customers.
Response process
Detection and containment
Automated monitoring detects anomalous access patterns. On confirmation, affected systems are isolated and access is restricted to the incident response team.
Investigation
The Security Officer leads a forensic investigation to determine scope, the categories of PHI affected, the number of individuals impacted, and intent.
Customer notification
Affected customers are notified without unreasonable delay and no later than 60 days from discovery. The notice covers date of breach, date of discovery, types of PHI involved, and recommended mitigation.
Remediation and review
After containment, root-cause analysis drives corrective actions and control updates. A post-incident report is provided to affected customers.
Talk to legal.
There is no published pen-test package. For a BAA or a control question, write legal@halopt.com.
Contact compliance
For questions about the HIPAA program, to request a Business Associate Agreement, or to discuss controls with your compliance team, contact us directly.