Security, HIPAA BAA, and Audit Logging
HealthCoder AI maintains the highest standards of security and compliance to protect your sensitive healthcare information. Our platform is designed to meet and exceed industry regulations and security requirements.
Last Updated: September 2025
Compliance Standards
HIPAA Business Associate Agreement (BAA)
Covered entities must have a BAA with vendors that create, receive, maintain, or transmit PHI. HealthCoder executes a BAA before production coding of identifiable clinical notes. HHS publishes the Business Associate guidance and the HIPAA Privacy and Security Rules. HIPAA does not “certify” software; the BAA plus Security Rule safeguards are the working model.
- BAA prior to production PHI
- Minimum necessary access to charts
- Breach notification support as contracted
HIPAA program (not a certification)
HIPAA does not certify software. HealthCoder is designed to support covered-entity and business-associate obligations through a BAA plus administrative, physical, and technical safeguards described on this page. Your policies remain required.
- Administrative safeguards
- Physical safeguards
- Technical safeguards
- Business associate agreements
SOC 2 Type II
SOC 2 Type II is an independent controls examination, not a HIPAA certificate. HealthCoder will share the current report during enterprise security review when a report exists. This page does not claim a public certification badge.
- Security controls
- Availability monitoring
- Confidentiality protection
- Processing integrity
ISO 27001
ISO 27001 is an information-security management standard. HealthCoder uses it as a control framework reference. Do not treat this heading as proof of a current ISO certificate unless a certificate is provided in diligence.
- Risk management
- Security policies
- Incident response
- Continuous improvement
Security Measures
Data Encryption
All data is encrypted using AES-256 encryption both in transit and at rest. We use industry-standard TLS 1.3 for secure communications.
- AES-256 encryption at rest
- TLS 1.3 for data in transit
- End-to-end encryption
- Key management best practices
Access Controls
Multi-layered access controls ensure only authorized personnel can access sensitive data with proper authentication and authorization.
- Multi-factor authentication (MFA)
- Role-based access control (RBAC)
- Principle of least privilege
- Regular access reviews
Infrastructure Security
Our cloud infrastructure is built with security-first principles, utilizing enterprise-grade security controls and monitoring.
- Secure cloud hosting
- Network segmentation
- Intrusion detection systems
- 24/7 security monitoring
Audit logging for coding and access
Audit logs record who viewed or exported a chart, which ICD-10-CM, CPT, or HCPCS suggestions were accepted or overridden, and when. That supports both HIPAA Security Rule audit controls and coding integrity reviews (payer, RAC, or internal compliance).
- User, chart, and timestamp on each coding action
- Accept vs override of ICD-10-CM, CPT, and HCPCS
- Export and view events for PHI access review
- Retention aligned to contract and HIPAA policies
Audit & Assessment
Regular Security Audits
We conduct comprehensive security audits on a regular basis to identify and address potential vulnerabilities.
- Quarterly security assessments
- Penetration testing
- Vulnerability scanning
- Code security reviews
Continuous Monitoring
Our security operations center provides 24/7 monitoring and rapid response to security incidents.
- 24/7 security operations
- Threat intelligence
- Incident response
- Security metrics tracking
Data Protection
- Data Classification: All data is classified based on sensitivity levels with appropriate protection measures for each classification.
- Data Retention: We maintain strict data retention policies that comply with healthcare regulations and business requirements.
- Data Backup: Regular, encrypted backups ensure data availability and recovery capabilities in case of system failures.
- Data Disposal: Secure data disposal procedures ensure that data is permanently and safely removed when no longer needed.
Employee Security
- Background Checks: All employees undergo comprehensive background checks before joining our team.
- Security Training: Regular security awareness training ensures all team members understand security best practices.
- Confidentiality Agreements: All employees sign strict confidentiality agreements to protect sensitive information.
- Access Management: Employee access is regularly reviewed and updated based on job requirements and security policies.
Incident Response
We maintain a comprehensive incident response plan to quickly and effectively address any security incidents:
- 1
Detection & Analysis
Automated monitoring systems detect potential security incidents and trigger immediate analysis.
- 2
Containment
Immediate containment measures prevent further damage and isolate affected systems.
- 3
Investigation
Thorough investigation determines the scope and impact of the security incident.
- 4
Recovery
Systems are restored to normal operation with enhanced security measures.
- 5
Lessons Learned
Post-incident analysis improves our security posture and response procedures.
Frequently asked questions
Does HealthCoder sign a HIPAA Business Associate Agreement?+
Yes. Production processing of PHI is intended to occur under a BAA. See HHS business associate guidance and request BAA language during contracting.
What does audit logging include?+
Coding suggestions, accepts, overrides, user identity, and timestamps so privacy and coding-integrity reviews can reconstruct who did what.
Is SOC 2 the same as HIPAA certification?+
No. HIPAA does not certify software. SOC 2 Type II is a controls examination when a report exists. Request HealthCoder’s current security packet during contracting; this site does not publish a certificate number.
Authoritative sources
Questions about our security?
We're happy to discuss our compliance and security practices.