Security & Trust

• TLS 1.2+ in transit

  All traffic between our apps and our servers travels over encrypted connections. Certificates are managed by our cloud provider and rotated automatically.

  Live

• AES-256 at rest

  Databases, file storage, and backups are encrypted at rest with AES-256 by our cloud provider, with keys managed in Google Cloud KMS.

  Live

• Customer-managed encryption keys (CMEK)

  Moving encryption keys under our own control so key rotation and revocation are independent of the platform default.

  In Progress

• Field-level encryption for clinical notes

  Additional encryption applied to the most sensitive clinical fields so that they remain unreadable even to platform-level operators.

  In Progress

• Individual accounts, no shared logins

  Every patient, practitioner, and staff member authenticates as themselves. Credentials are never shared between people.

  Live

• Role-based access control (RBAC)

  Practitioner, patient, support, and administrator roles are strictly separated so each role reaches only the records it needs.

  Live

• Database-enforced record isolation

  Authorization rules are enforced in the database tier so a patient record is reachable only by that patient and their assigned care team — enforced cryptographically on the server.

  Live

• Multi-factor authentication (MFA)

  MFA will be required for every practitioner and administrator account, and offered to patients.

  In Progress

• Automatic session timeout

  Idle sessions end automatically (15 minutes for staff, 30 minutes for patients) requiring re-authentication, as required by HIPAA §164.312(a)(2)(iii).

  Live

• Quarterly access reviews

  A recurring review confirming that every account still needs the access it holds, with removals documented.

  In Progress

• Managed cloud hosting (Google Cloud / Firebase)

  The platform runs on Google Cloud Platform, which maintains its own SOC 2, ISO 27001, and HITRUST certifications for the underlying infrastructure.

  Live

• United States data residency

  Confirming and pinning every data store to United States regions, and documenting the result.

  In Progress

• Private networking / VPC Service Controls

  A service perimeter around production data so it cannot be reached from the public internet, only from authorized services.

  In Progress

• Web Application Firewall & DDoS protection

  Edge filtering for common web attacks and volumetric traffic floods.

  In Progress

• Infrastructure and application logging

  Server activity and errors are captured in Google Cloud Logging.

  Live

• PHI access audit trail

  An immutable, six-year audit log recording access to consultation tokens, patient charts, and record modifications — satisfying HIPAA §164.312(b).

  Live

• Automated alerting on anomalous access

  Alerts on unusual access patterns, such as bulk record reads or logins from unexpected locations.

  In Progress

• Log integrity protection

  Write-once retention so audit logs cannot be altered or deleted, including by administrators.

  In Progress

• Automated daily backups

  Scheduled, encrypted backups of all patient data with a defined retention window.

  In Progress

• Tested restore procedure

  A documented contingency plan with a restore drill performed and recorded at least annually, as HIPAA requires.

  In Progress

• Published RTO / RPO targets

  Formal recovery time and recovery point objectives, published here once tested and met.

  In Progress

• Designated Security Officer and Privacy Officer

  Two named individuals formally accountable for the security and privacy programs, as HIPAA requires.

  In Progress

• Annual workforce HIPAA training

  Required annual training for everyone who touches code, infrastructure, or patient support, with completion records kept.

  In Progress

• Annual Security Risk Analysis

  A documented, repeated assessment of risks to health information and the plan to remediate them.

  In Progress

• Incident Response & Breach Notification Plan

  A written plan covering detection, containment, and notification within the timelines set by the HIPAA Breach Notification Rule.

  In Progress

• Written policies and procedures

  The full HIPAA policy set — sanction policy, workstation use, media disposal, contingency planning, and more.

  In Progress

• Background checks for workforce with PHI access

  Pre-engagement screening for anyone who can reach patient data.

  In Progress

1. Phase 1 · Now → 90 days

   HIPAA Security Rule remediation

   In Progress
   • Close all critical access-control gaps
   • Execute Business Associate Agreements with every vendor touching PHI
   • Stand up the PHI access audit trail
   • Appoint Security and Privacy Officers
   • Complete the first documented Security Risk Analysis

2. Phase 2 · 3 → 6 months

   Policy, training, and independent testing

   In Progress
   • Publish the full written policy set
   • Complete annual workforce HIPAA training
   • Third-party penetration test with remediation
   • Tested backup and disaster recovery drill

3. Phase 3 · 6 → 12 months

   SOC 2 Type I

   In Progress
   • Independent CPA firm attests that controls are designed correctly
   • Report available to enterprise partners under NDA

4. Phase 4 · Year 2

   SOC 2 Type II

   In Progress
   • Controls proven to operate effectively over a 6–12 month window
   • Continuous control monitoring in place

5. Phase 5 · Year 2+

   HITRUST or ISO 27001

   In Progress
   • Pursued when required by hospital systems or enterprise health partners

• Sample Business Associate Agreement

  In Progress

  Our standard BAA template for enterprise and provider partners.

• Penetration test summary

  In Progress

  Executive summary of our most recent third-party security test.

• SOC 2 Type I report

  In Progress

  Available to prospective partners under NDA once issued.

• Security Risk Analysis summary

  In Progress

  High-level findings and remediation status from our annual analysis.

• Architecture and data-flow diagram

  In Progress

  How health information moves through our systems, end to end.

To start a review, write to info@ambewellness.com.

• Access your records

  Request a copy of the health information we hold about you.

• Request a correction

  Ask us to amend information you believe is inaccurate.

• An accounting of disclosures

  Ask who your information has been shared with, and why.

• Request restrictions

  Ask us to limit how your information is used or disclosed.

• File a complaint

  Raise a concern with us directly, or with the U.S. Department of Health and Human Services Office for Civil Rights. We will never retaliate.

To exercise any of these rights, contact info@ambewellness.com. See also our Privacy Policy.