HIPAA Compliance

🛡️ Security Measures

• Encryption: AES-256 encryption at rest, TLS 1.3 in transit
• Authentication: Multi-factor authentication (MFA) required for all users
• Access Control: Role-based access controls (RBAC) with least privilege
• Session Management: Automatic timeout after 15 minutes of inactivity
• Audit Logging: Complete audit trails of all PHI access (view, edit, delete)
• Penetration Testing: Annual third-party security audits
• Vulnerability Scanning: Weekly automated scans
• Incident Response: 24/7 security monitoring and response team
• Data Backup: Geo-redundant backup with point-in-time recovery
• Disaster Recovery: RTO of 4 hours, RPO of 15 minutes

📋 Audit & Monitoring

Continuous Monitoring

• Real-time monitoring of all system access
• Automated alerts for suspicious activity
• SIEM integration with 1-year log retention
• User activity tracking (logins, exports, modifications)

Regular Audits

• Quarterly internal compliance audits
• Annual third-party HIPAA risk assessments
• Penetration testing by certified professionals
• Vendor risk assessments for all subcontractors

Audit Logs Include

• User ID and role of person accessing PHI
• Date and time of access (timestamp)
• Action performed (view, create, modify, delete)
• Patient identifiers accessed
• IP address and device information
• Success/failure status of action

📄 Business Associate Agreements

IntakeAccess.ai executes BAAs with all covered entities and business associates. Our BAA covers:

• All IntakeAccess.ai services and features
• All subcontractors (Twilio, Firebase, Google Cloud)
• Permitted uses and disclosures of PHI
• Security safeguards and breach notification
• Audit rights and compliance monitoring
• Termination provisions
• Indemnification clauses

📨 Request a BAA

To request a signed Business Associate Agreement:

Include in your request:

• Entity name and type (provider, hospital, etc.)
• Contact information for signing authority
• EIN/Tax ID
• Preferred BAA template type

⚠️ Breach Notification Process

In accordance with 45 CFR § 164.410, IntakeAccess.ai follows strict breach notification procedures:

Immediate Response (Within 24 Hours)

• Internal incident response team activated
• Containment and investigation initiated
• Preservation of evidence and logs

Risk Assessment (Within 3 Days)

• Determine likelihood of PHI compromise
• Identify affected individuals
• Evaluate scope and severity

Notification Timeline

• Covered Entities: Notified immediately upon confirmation
• Affected Individuals: Within 60 days of discovery
• HHS Secretary: As required by breach size (immediate for 500+)
• Media: For breaches affecting 500+ residents

Breach Hotline: 205-855-4545 (available 24/7)