HIPAA Security Rule controls

Risk analysis §164.308(a)(1)(ii)(A)

Threat model and risk register covering confidentiality, integrity and availability of ePHI; being formalised into a periodic process.

Risk management §164.308(a)(1)(ii)(B)

Security measures sized to reduce identified risks (encryption, isolation, rate limits); treatment tracking maturing.

Sanction policy §164.308(a)(1)(ii)(C)

Workforce disciplinary policy for security-policy violations to be adopted as the team grows.

Information system activity review §164.308(a)(1)(ii)(D)

An append-only audit log records logins, platform actions and clinical events with actor, role, target, IP and timestamp, reviewable by admins (own clinic) and the platform team (all).

Assigned security responsibility §164.308(a)(2)

Security ownership assigned; a named security/privacy officer role is being designated.

Authorization & supervision §164.308(a)(3)(ii)(A)

Six tenant roles + fine-grained platform roles; access to ePHI is need-to-know and enforced server-side.

Workforce clearance §164.308(a)(3)(ii)(B)

Least-privilege by role: reception, doctor, pharmacist and platform roles each see only what they need.

Termination procedures §164.308(a)(3)(ii)(C)

Accounts can be deactivated instantly (active flag); a deactivated login is refused at sign-in.

Isolating clearinghouse function §164.308(a)(4)(ii)(A)

The product is not a healthcare clearinghouse.

Access authorization §164.308(a)(4)(ii)(B)

Access to records is granted per role on a need-to-know basis; cross-tenant access is impossible by design.

Access establishment & modification §164.308(a)(4)(ii)(C)

Admins provision, modify and revoke staff access from the console; changes take effect immediately.

Security reminders / awareness training §164.308(a)(5)(ii)(A)

Recurring security-awareness training and induction training to be rolled out via a GRC process.

Protection from malicious software §164.308(a)(5)(ii)(B)

Endpoint protection and malware guidance to be formalised for the workforce.

Log-in monitoring §164.308(a)(5)(ii)(C)

Failed-login and OTP attempts are rate-limited and throttled per IP and per identity; anomalies surface in logs.

Password management §164.308(a)(5)(ii)(D)

Staff passwords hashed with bcrypt; patients use hashed, expiring OTPs; JWT secret strength enforced in production.

Security incident response & reporting §164.308(a)(6)

Incident triage, containment and reporting runbook aligned to DPDP timelines; being documented formally.

Data backup plan §164.308(a)(7)(ii)(A)

Nightly encrypted database backups with retention are documented for deployment.

Disaster recovery plan §164.308(a)(7)(ii)(B)

Restore procedures and a documented DR plan on the roadmap.

Emergency mode operation plan §164.308(a)(7)(ii)(C)

Business-continuity plan for critical processes during emergencies to be defined.

Testing & revision of contingency plans §164.308(a)(7)(ii)(D)

Periodic BCP/DR testing to be scheduled.

Applications & data criticality analysis §164.308(a)(7)(ii)(E)

Criticality ranking of applications and data to feed contingency planning.

Evaluation (technical & non-technical) §164.308(a)(8)

Annual vulnerability assessment and penetration testing (VAPT) planned.

Business associate contracts §164.308(b)

DPAs/BAAs with sub-processors (e.g. cloud host, payments, messaging); AWS BAA in place for managed hosting.

Contingency operations §164.310(a)(2)(i)

Facility access to support data restoration is covered by the cloud provider's DR and our procedures.

Facility security plan §164.310(a)(2)(ii)

Hosting in AWS (ap-south-1): physical security, tamper and theft protection provided by the cloud provider under its BAA/attestations.

Access control & validation §164.310(a)(2)(iii)

Physical access to infrastructure is controlled and validated by the cloud provider; no on-prem ePHI by default.

Maintenance records §164.310(a)(2)(iv)

Infrastructure change/maintenance records maintained via provider and our change log.

Workstation use §164.310(b)

Acceptable-use policy for workstations accessing ePHI to be adopted.

Workstation security §164.310(c)

Physical safeguards for staff workstations to be documented.

Device & media disposal §164.310(d)(2)(i)

Media disposal handled by the cloud provider's certified processes; app data is encrypted at rest.

Media re-use §164.310(d)(2)(ii)

ePHI removed before media re-use per provider controls and encryption-at-rest.

Accountability §164.310(d)(2)(iii)

Records of hardware/media movement to be maintained where applicable.

Data backup & storage §164.310(d)(2)(iv)

Retrievable encrypted backups maintained before infrastructure changes.

Unique user identification §164.312(a)(2)(i)

No shared/generic logins. Every staff and patient identity is unique and every action is attributable.

Emergency access procedure §164.312(a)(2)(ii)

Break-glass emergency access to records with heightened logging to be added.

Automatic logoff §164.312(a)(2)(iii)

Signed-in sessions are automatically ended after 15 minutes of inactivity so an unattended workstation cannot expose ePHI.

Encryption & decryption (at rest) §164.312(a)(2)(iv)

ePHI (PII, notes, diagnoses, prescriptions, vitals) encrypted field-by-field with AES-256-GCM before storage.

Audit controls §164.312(b)

A dedicated append-only AuditLog records who did what, when and from where; entries survive record deletion and are queryable in the console.

Integrity: authenticate ePHI §164.312(c)(2)

AES-256-GCM provides an authentication tag that detects any tampering; access to ePHI is limited and approved.

Person or entity authentication §164.312(d)

Users are authenticated (OTP for patients, password for staff) before any access to systems or information.

Transmission integrity controls §164.312(e)(2)(i)

Data in transit is protected against undetected modification via TLS with HSTS and strict headers.

Transmission encryption §164.312(e)(2)(ii)

All ePHI in transit is encrypted with TLS 1.2+; payment callbacks are signature-verified.

Business associate contracts §164.314(a)(2)(i)

Written agreements requiring sub-processors to safeguard ePHI, report incidents and permit termination on breach.

Other arrangements §164.314(a)(2)(ii)

Applies only where both parties are government entities. Not applicable to a private SaaS.

Requirements for group health plans §164.314(b)

The product does not disclose ePHI to a group-health-plan sponsor.

Policies & procedures §164.316(a)

Information-security policies and procedures being documented to cover each safeguard above.

Documentation retention (6 years) §164.316(b)(2)(i)

Six-year retention of security documentation and records to be operationalised.

Documentation availability §164.316(b)(1)

Security documentation made available to those responsible for implementing the controls.

Periodic review & updates §164.316(b)(1)

Documentation reviewed and updated in response to operational or environmental changes.