Protecting patient data is not just a feature — it's the foundation of everything we build. CaseMgmt is designed from the ground up to meet HIPAA requirements and industry security standards.
Every layer of CaseMgmt is built with security in mind.
CaseMgmt implements all three categories of HIPAA safeguards to protect electronic Protected Health Information (ePHI).
CaseMgmt provides a signed Business Associate Agreement (BAA) to all customers who manage Protected Health Information through our platform. Our BAA covers all aspects of HIPAA compliance including data handling, breach notification, and subcontractor management.
Yes. CaseMgmt is fully HIPAA compliant and implements all required administrative, physical, and technical safeguards. We provide a signed Business Associate Agreement (BAA) to all customers.
All data is stored on Amazon Web Services (AWS) infrastructure within the United States. AWS maintains a signed BAA with us and meets all HIPAA requirements for hosting electronic PHI.
Yes. All data is encrypted at rest using 256-bit AES encryption and in transit using TLS 1.2 or higher. Database connections, backups, and file storage are all encrypted.
No. CaseMgmt uses strict multi-tenant data isolation. Each company's data is logically separated at the database level. Users can only access data belonging to their own organization.
We have a documented incident response plan. In accordance with HIPAA breach notification requirements, we notify affected customers of a breach of unsecured PHI without unreasonable delay and no later than 60 days after discovery. We notify account holders of non-PHI account security incidents within 72 hours of confirmation.
Yes. We conduct security assessments, dependency vulnerability scanning, and code reviews, and we log security-relevant events for review.