HIPAA Compliance
OccDocs is designed from the ground up for HIPAA compliance. Our core architecture eliminates PHI risk at the source: we never store it.
Zero PHI Storage
No protected health information is ever written to our database. All encounter data is anonymized using HIPAA Safe Harbor (45 CFR §164.514(b)) before processing.
Safe Harbor De-identification
We apply all 18 HIPAA Safe Harbor identifiers removal: names, dates (beyond year), geographic subdivisions smaller than state, phone numbers, SSNs, medical record numbers, and more.
Immutable Audit Log
Every authentication event, AI query, and data mutation is logged with timestamp, user ID, and action type. Logs use only anonymized session identifiers — no PHI.
Encryption in Transit & at Rest
All data is encrypted in transit via TLS 1.3. Database encryption at rest using AES-256. HTTPS is enforced with HSTS headers.
Access Controls
Multi-tenant isolation ensures organizations can never access other organizations' data. Role-based access control limits data access to authorized users.
BAA Available
A Business Associate Agreement is available for Enterprise customers. Contact sales to execute a BAA before onboarding.
Questions about HIPAA compliance? Contact our security team at [email protected]. Enterprise customers can request our Security & Compliance documentation package.