HIPAA Compliance in Decisions

Overview

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) is a federal law that requires the creation of national standards to protect sensitive patient health information from being disclosed without the patient's consent or knowledge. In the course of providing services to healthcare customers, Decisions can be HIPAA compliant through the server configuration.

Configurations

Decisions support HIPAA compliance through different configurations of its data storage and the data structures used within the Decisions platform. In its default setup, Decisions does not store customer data. Decisions stores ‘metadata’ related to your Flow designs and layout. The datatypes used within Decisions can also be configured with 256-bit AES encryption to protect transactional both at rest and in transit. Out of the box, Decisions can be used in a HIPAA-compliant manner, with advanced levels of security available via external integrations and configuration.

HIPAA Rules and Decisions

The following table contains additional information on how Decisions can be configured to account for multiple HIPAA safeguards and practices.

Further Certification

SOC2: The SOC 2 report provides third-party assurance that the design of Decisions and our internal processes and controls meet the strict audit requirements set forth by the American Institute of Certified Public Accountants (AICPA) standards for security, availability, confidentiality, and privacy. The SOC 2 report is the de facto assurance standard for software providers. Decisions SOC 2 Cert is expected to be available in Q3 2022.