How we're approaching security and HIPAA
Korafy is preparing its platform for HIPAA-regulated use. Here's where we are, and what happens before any patient data is involved.
Book a free 20-minute conversation (opens in a new tab)No patient data before a signed BAA
Korafy will sign a Business Associate Agreement with each participating practice before processing any patient data on its behalf. Our current conversations with practices don't involve patient information.
Safeguards we're putting in place
Administrative
- Designated HIPAA Security OfficerPlanned
- Workforce training on PHI handlingPlanned
- Quarterly risk assessmentsPlanned
- Incident response planPlanned
- BAAs with AWS and Neon
Physical
- Cloud-hosted, with no on-premise servers
- HIPAA-eligible cloud infrastructure
- Facility access controls via the cloud provider
- Workstation use policies
Technical
- AES-256 at rest
- TLS 1.3 in transit
- Role-based access controlPlanned
- Audit logging
- Session timeoutPlanned
- MFAPlanned
How data will be stored and protected
Encrypted data storage
Korafy is designed so that patient data is encrypted at rest (AES-256) and in transit (TLS 1.3), with encrypted backups.
Hosting and BAAs
Korafy runs on HIPAA-eligible cloud infrastructure: AWS (hosting) and Neon (database). We have Business Associate Agreements with AWS and Neon, and are verifying account-level coverage and configuration. Before any patient information is sent through Telnyx, we'll have the required agreements in place.
Audit logging
Korafy is designed to log every access to patient data with timestamp, user and action.
Compliance roadmap
HIPAA Administrative, Physical & Technical Safeguards
In progressBeing put in place; see the safeguards list above.
Business Associate Agreements
In progressIn place with AWS and Neon. We'll sign a BAA with each practice before any patient data is involved.
SOC 2 Type I
PlannedPlanned. We'll publish a target date once an audit firm is engaged.
SOC 2 Type II
PlannedPlanned, following SOC 2 Type I.
Questions about security? Let's talk.
We're happy to walk through our approach, what's in place today, and when we'd sign a BAA, before any pilot begins.