> ## Documentation Index
> Fetch the complete documentation index at: https://trust.denialbase.com/llms.txt
> Use this file to discover all available pages before exploring further.

# HIPAA readiness

> How Denialbase aligns with the HIPAA Security, Privacy, and Breach Notification rules. We are HIPAA-ready, not formally HIPAA-certified.

<Info>
  Denialbase operates as a HIPAA business associate for healthcare providers (covered entities) and signs a BAA before any PHI moves. This page describes the administrative, physical, and technical safeguards we apply to PHI. Denialbase is HIPAA-ready and has not undergone formal HIPAA certification.
</Info>

## Administrative safeguards

<AccordionGroup>
  <Accordion title="Security management process" icon="list-check">
    * Risk analysis performed quarterly and after any material architecture change.
    * Risk register tracks threats with owner, likelihood, impact, and mitigation — first public version targeted for Q2 2026.
    * Sanction policy for workforce members who violate policies.
  </Accordion>

  <Accordion title="Assigned security responsibility" icon="user-tie">
    Denialbase has a designated Security Officer and Privacy Officer responsible for HIPAA compliance. Contact via [security@denialbase.com](mailto:security@denialbase.com) or [privacy@denialbase.com](mailto:privacy@denialbase.com).
  </Accordion>

  <Accordion title="Workforce security" icon="users">
    * Background checks required for all employees and contractors with production access.
    * Role-based authorization following least-privilege.
    * Offboarding runbook revokes all access within 24 hours of termination.
    * HR security policy and formal onboarding/offboarding documentation: in development, target Q2 2026.
  </Accordion>

  <Accordion title="Workforce training" icon="graduation-cap">
    * HIPAA awareness training on hire and annually thereafter.
    * Developer-specific secure-coding training focused on OWASP Top 10 and common Rails/React pitfalls.
    * Incident response tabletop exercises (planned Q2 2026).
  </Accordion>

  <Accordion title="Business Associate Agreements" icon="file-contract">
    * We execute BAAs with every covered-entity customer.
    * We require BAAs from every subprocessor that may touch PHI.
    * See [BAAs](/trust/baa) for the request process and current status.
  </Accordion>

  <Accordion title="Contingency plan" icon="rotate-left">
    * Data backup plan — daily automated Cloud SQL backups + continuous WAL for PITR.
    * Disaster recovery plan — documented procedures for backup verification, PITR, full restore, and tabletop.
    * Emergency mode operation — documented degraded-mode procedures.
    * See [Disaster recovery](/trust/disaster-recovery).
  </Accordion>

  <Accordion title="Evaluation" icon="clipboard-check">
    Periodic technical and non-technical evaluation of HIPAA safeguards, including internal reviews and — once contracted — annual third-party pentest.
  </Accordion>
</AccordionGroup>

## Physical safeguards

Denialbase is a cloud-native application. We do not operate our own data centers.

<CardGroup cols={2}>
  <Card title="GCP data center controls" icon="building-shield">
    Google Cloud is SOC 1/2/3, ISO 27001/27017/27018, and HITRUST certified. Physical controls (biometric access, 24/7 guards, environmental monitoring) are inherited from GCP.
  </Card>

  <Card title="Workstation controls" icon="laptop">
    Denialbase workforce workstations are managed with full-disk encryption, automatic lock, patching enforcement, and EDR agent.
  </Card>
</CardGroup>

## Technical safeguards

<AccordionGroup>
  <Accordion title="Access controls — §164.312(a)" icon="lock">
    * Unique user identification (UUID primary keys per user).
    * Emergency access procedure documented.
    * Automatic logoff after 30 minutes inactivity.
    * Encryption + decryption — [see Encryption](/trust/encryption).
  </Accordion>

  <Accordion title="Audit controls — §164.312(b)" icon="clipboard-list">
    * `hipaa_audit_logs` pipeline records every PHI access with 7-year retention.
    * [See Audit logging](/trust/audit-logging) for details.
  </Accordion>

  <Accordion title="Integrity — §164.312(c)" icon="shield-check">
    * Database is write-once for audit tables; application cannot update or delete audit rows.
    * All writes to PHI are authenticated and audit-logged.
    * Backups verified (cadence targeted Q2 2026).
  </Accordion>

  <Accordion title="Person or entity authentication — §164.312(d)" icon="fingerprint">
    * 2FA required for every account with PHI access (TOTP or passkey).
    * Passwords meet HIPAA-aligned complexity rules (12+ chars, mixed classes).
    * [See Authentication & access control](/trust/authentication).
  </Accordion>

  <Accordion title="Transmission security — §164.312(e)" icon="network-wired">
    * TLS 1.2+ for all external traffic.
    * Private VPC for internal traffic.
    * No PHI ever sent in email bodies.
    * [See Network security](/trust/network-security).
  </Accordion>
</AccordionGroup>

## Breach notification

Under §164.400–414 we commit to:

* **Detection** — automated alerts on abnormal access patterns (bulk exports, off-hours admin, failed-login spikes).
* **Triage** — incident responder acknowledges within 1 hour business-time / 4 hours off-hours.
* **Assessment** — probability-of-compromise analysis per §164.402 within 24 hours.
* **Notification** — if a breach is confirmed, we notify affected covered-entity customers **without unreasonable delay** and no later than **60 days** after discovery, per §164.410.
* **Documentation** — every incident, breach or not, is written up and retained for 6 years.

## Data subject rights

Through the covered-entity relationship, patients can exercise their HIPAA rights via their provider. Denialbase supports:

* Access to PHI in our systems via the provider's admin panel.
* Amendment requests routed through the provider.
* Accounting of disclosures from the `hipaa_audit_logs` pipeline.
* Restriction requests via ticket to the covered entity.

## Retention

| Data                    | Retention                                               |
| ----------------------- | ------------------------------------------------------- |
| Active account data     | While the account is active                             |
| Integration-synced data | While the integration is connected                      |
| `hipaa_audit_logs`      | 7 years                                                 |
| `security_audit_logs`   | 7 years                                                 |
| Deleted account data    | Purged on account deletion (`User#permanently_delete!`) |

## Questions

Security questions: [security@denialbase.com](mailto:security@denialbase.com).
Privacy questions: [privacy@denialbase.com](mailto:privacy@denialbase.com).