Security & HIPAA ComplianceEnterprise-Grade Security
OptraHEALTH meets the highest healthcare security and compliance standards, protecting patient data and organizational integrity.
Certifications & Compliance
HIPAA Compliant
Full HIPAA compliance with Business Associate Agreements (BAA) for healthcare organizations.
SOC 2 Type II
Independent third-party audit verifying security, availability, and confidentiality controls. Report available under NDA.
HITRUST Certified
Certified against the HITRUST framework, the healthcare industry’s leading security standard. Certification letter available on request.
GDPR & CCPA Ready
Full compliance with EU and US data privacy regulations.
Security Features
End-to-End Encryption
- ✔ AES-256 encryption for data at rest
- ✔ TLS 1.3 for data in transit
- ✔ Database-level encryption with secure key management
- ✔ Field-level encryption for sensitive healthcare data
Access & Authentication
- ✔ Multi-factor authentication (MFA)
- ✔ Role-based access control (RBAC)
- ✔ SSO integration with enterprise identity providers
- ✔ Audit logging of all data access and changes
Data Isolation & Privacy
- ✔ Logical data isolation between clients
- ✔ Row-level security policies
- ✔ HIPAA-compliant data retention policies
- ✔ Secure data deletion procedures
Infrastructure & Monitoring
- ✔ Hosted on Microsoft Azure HIPAA-eligible cloud infrastructure
- ✔ 24/7 security monitoring and threat detection
- ✔ Automated vulnerability scanning
- ✔ Incident response procedures
Compliance & Regulatory
Healthcare Standards
- • HIPAA Privacy & Security Rules
- • HITECH Breach Notification Rule
- • HL7 FHIR Standards
- • CMS Quality Reporting Requirements
Data Privacy Laws
- • GDPR (EU General Data Protection)
- • CCPA (California Privacy Rights)
- • State Health Privacy Laws
- • Data Residency Requirements
Data Security Practices
Preventive Measures
- → Regular security assessments
- → Penetration testing
- → Employee security training
- → Vendor security reviews
Response & Recovery
- → 24/7 incident response team
- → Breach notification procedures
- → Business continuity planning
- → Disaster recovery procedures
Compliance Details for Security Reviews
Healthcare buyers need specifics, not badges. Here is what each attestation covers and what we can share with your security and compliance teams.
HIPAA and Business Associate Agreements
OptraHEALTH acts as a business associate to the healthcare organizations we serve. We sign a BAA with customers that share protected health information (PHI) with us, and our safeguards follow the HIPAA Privacy, Security and Breach Notification Rules.
SOC 2 Type II
An independent auditor has tested our controls for security, availability and confidentiality over a review period, not just at a single point in time. The current SOC 2 Type II report is available under NDA.
HITRUST certification
OptraHEALTH is HITRUST certified. The HITRUST framework brings HIPAA, NIST and ISO requirements together into one set of controls that many health systems ask their vendors to meet. Our certification letter is available on request.
Microsoft Azure hosting
The platform runs on Microsoft Azure HIPAA-eligible services. Data is encrypted with AES-256 at rest and TLS 1.3 in transit, with database-level and field-level encryption for sensitive healthcare data.
Protecting PHI in AI Workflows
AI raises new questions for security teams: where PHI goes, which models see it, and who checks the output. This is how we answer them.
- • Private models. Custom LLMs run in private environments, including HIPAA-compliant on-premises hosting where required, rather than on shared public models.
- • De-identification. EMR data can be extracted and anonymized before it is prepared for model use.
- • Least-privilege access. Role-based access control, multi-factor authentication and SSO with your identity provider, with every data access and change written to an audit log.
- • Human review. Clinical and financial outputs stay human-in-the-loop, so people make the final decision.
What You Can Request
For vendor risk assessments, our team can share:
- • Our SOC 2 Type II report (under NDA)
- • Our HITRUST certification letter
- • A Business Associate Agreement for your review
- • A security brief covering architecture, encryption, access control and incident response
Security FAQ
Does OptraHEALTH sign a Business Associate Agreement (BAA)?
Yes. We sign a BAA with healthcare customers that share protected health information (PHI) with us, and our safeguards follow the HIPAA Privacy, Security and Breach Notification Rules.
Do you have a SOC 2 Type II report?
Yes. An independent auditor has tested our security, availability and confidentiality controls over a review period. The current report is available to customers and prospects under NDA.
Is OptraHEALTH HITRUST certified?
Yes. OptraHEALTH is HITRUST certified, and our certification letter is available on request.
Where is customer data hosted?
The platform runs on Microsoft Azure HIPAA-eligible services. Data is encrypted with AES-256 at rest and TLS 1.3 in transit, and each client’s data is logically isolated.
Can AI models run in our own environment?
Yes. Custom LLMs can be deployed privately, including HIPAA-compliant on-premises hosting where your policies require it.
How do you handle security incidents?
We run 24/7 security monitoring and threat detection, keep a 24/7 incident response team, and follow documented breach notification procedures in line with the HITECH Breach Notification Rule.
Your Data. Protected.
Learn how OptraHEALTH's security infrastructure protects your organization.