HIPAA-aligned safeguards, verified in the product
This page lists the safeguards actually implemented in the deployed ClinicalHIS platform, mapped to the HIPAA Security Rule's themes. Every control below is verifiable in the product; where something is not yet implemented, we say so plainly.
Technical safeguards (implemented)
Encrypted transport
All traffic served over HTTPS with TLS 1.2/1.3, forward-secret ciphers and HSTS (preload). Plain HTTP is redirected. Internal services run on an isolated container network.
Multi-factor authentication
Time-based one-time codes (authenticator apps), WebAuthn passkeys and single-use backup codes. MFA can be enforced platform-wide and is enforced for sensitive roles; administrators can force re-enrolment and reset factors with step-up verification.
Role-based access & tenant scoping
Permission sets per role; every clinical query is scoped to the user's hospital (tenant). Configurable per-tenant permission restrictions; least-privilege application database access.
Append-only audit trail
Audit records cannot be updated or deleted (database triggers reject it) and carry per-row checksums with integrity-verification functions. Login history and PHI-access logging included.
Session controls
Idle session timeout (default 15 minutes), short-lived access tokens with server-side revocation, HttpOnly refresh cookies, CSRF protection, account lockout and rate limiting.
Field-level encryption
AES-256-GCM encryption at the field level for MFA secrets and integration credentials.
What we do not claim
Honesty in compliance claims matters. ClinicalHIS today does NOT have: full disk/volume encryption of hosting servers (encryption at rest beyond the field-level encryption above); off-site backup replication (backups are local to the hosting server); SOC 2, ISO 27001 or any other certification; or a 24/7 staffed security operations centre. Audit logging covers the platform's modules extensively but we do not claim literally every read event is logged. Where your risk assessment requires strictest physical control, tenant-local hosting keeps the entire stack on your own hardware.
Patient rights through your provider
HIPAA rights belong to patients and are exercised through their Covered Entity — the hospital. Through ClinicalHIS the hospital can provide portal access to records and results, correct records with full version history, and produce audit evidence of who accessed what. Claridad assists the hospital behind the scenes with its Business Associate duties (including breach notification within 48 hours of awareness).
Privacy Policy →Business Associate Agreement
A BAA is available on request for US Covered Entity clients (privacy@clinicalhis.com). Our standard data-protection terms — the DPA with its US annex reserved for the executed BAA — are public at /legal/dpa.
Compliance questions
Claridad Health Solutions • ClinicalHIS • HIPAA-aligned safeguards, honestly described • Version 2026.1