HIPAA-Aligned Healthcare Safeguards
Designed around the administrative, physical, and technical safeguards of the Health Insurance Portability and Accountability Act (HIPAA) Security Rule and the Health Information Technology for Economic and Clinical Health (HITECH) Act.
Administrative Safeguards
Policies and procedures for managing PHI access and workforce training
- • Designated Security Officer (interim); workforce training program in progress
- • Business Associate Agreements (BAAs) with vendors that process health information: executed with our primary AI provider, other core vendors in progress
- • Every HIPAA safeguard tracked in an internal compliance matrix
- • Risk management procedures; formal risk analysis in progress
- • Incident response and breach notification protocols
Physical Safeguards
Protection of computer systems and equipment from physical threats
- • Hosting providers' secure data centers with 24/7 monitoring
- • Facility access controls managed by our hosting providers
- • Workstation and device security policies (in progress)
- • Media disposal and re-use procedures (in progress)
Technical Safeguards
Technology controls that protect electronic PHI
- • Role-based access controls and row-level security
- • AES-256 encryption at rest and TLS in transit
- • Audit controls and integrity monitoring
- • Automatic logoff and transmission security
ISO 27001 & SOC 2 Alignment
Our security program is modeled on ISO/IEC 27001 and the SOC 2 Trust Services Criteria. VHT does not yet hold ISO 27001 or SOC 2 certification; we are working toward SOC 2 and run on infrastructure providers that hold SOC 2 Type II and ISO 27001 reports.
ISO 27001:2022 Principles
Information security management practices
Our policies and controls follow ISO 27001:2022 principles to manage information security risks. VHT is not ISO 27001 certified.
SOC 2 Trust Services Criteria
Control design guided by the criteria
Our security controls are designed with the SOC 2 Trust Services Criteria in mind to safeguard member and customer data.
Working Toward SOC 2
Independent attestation on our roadmap
VHT has not yet completed a SOC 2 examination. We are building the monitoring and evidence needed for a future independent SOC 2 report, and our hosting providers hold their own SOC 2 Type II and ISO 27001 reports.
Comprehensive Security Framework
Multi-layered security approach protecting patient data at every level
Data Encryption
Encryption in transit and at rest for all patient data
- • AES-256 encryption at rest
- • TLS 1.2+ for data in transit
- • HSTS enforced on vht.ai and its subdomains
- • Encryption keys managed by our hosting provider
Access Control
Role-based permissions and authentication
- • Sign in with Apple or Google (two-factor depends on your Apple or Google account settings)
- • Role-based access control (RBAC)
- • Row-level security (RLS)
- • Principle of least privilege
Audit & Monitoring
Audit logging, edge protection and alerting
- • Append-only audit trails with daily integrity checks
- • Security event logging and alerting
- • Cloudflare edge protection (WAF rules, Bot Fight Mode and rate limiting)
- • Documented incident response runbook
Risk Management
Proactive risk assessment and mitigation
- • Periodic internal security reviews and Supabase advisor checks
- • Database access-control (RLS) audits
- • Nightly backups with point-in-time recovery (Supabase)
- • Contingency and disaster recovery planning (in progress)
Compliance & Standards
Controls aligned with industry-standard frameworks
- • HIPAA/HITECH-aligned safeguards
- • Working toward SOC 2
- • GDPR-aligned data rights for EU users
- • Hosting providers with SOC 2 Type II and ISO 27001 reports
Patient Rights
Protecting patient privacy and data rights
- • Right to access and portability
- • Data deletion and correction rights
- • Transparent consent management
- • Privacy preference controls