Agreement: BAA with every customer
Framework: HIPAA Security Rule
Audit: SOC 2 Type II in progress

Built for HIPAA, stated plainly.

NanoSense processes protected health information under a Business Associate Agreement, with safeguards mapped to the HIPAA Security Rule (45 CFR Part 164, Subpart C).

Statements

Data availability: PostgreSQL Row-Level Security enforces tenant boundaries at the database itself. Isolation is enforced in the database layer, so a defect in application code does not by itself expose another tenant’s data.
Competing interests: None. NanoSense is read-only and cannot change your EMR.
Compliance: Built for HIPAA. We sign a Business Associate Agreement with every customer. SOC 2 Type II is in progress.
Audit: Every API request, database write, and application event is logged, with patient identifiers hashed and PHI redacted. Audit logs are retained for 10 years.

Methods: defense in depth

Multiple security boundaries sit between the internet and your data. Traffic passes through them in this order.

**Table 1.** Security layers, outermost first.
Layer	Controls
1. Internet	All external traffic enters here
2. API Gateway	TLS 1.2+ termination, sole entry point, WAF
3. Private ALB	Private subnets only, not internet-facing
4. ECS Fargate	Private subnets, no public IPs
5. RDS PostgreSQL	Private subnets, KMS encryption, forced SSL

Safeguards that protect PHI

**Table 2.** Safeguards and what each one does.
Safeguard	Detail
Encryption in transit and at rest	AES-256 at rest with customer-managed KMS keys and annual rotation. TLS 1.2+ in transit, with SSL enforced on the database. Sensitive fields are additionally encrypted at the application layer.
Tenant isolation	PostgreSQL Row-Level Security enforces tenant boundaries at the database itself. Isolation is enforced in the database layer, so a defect in application code does not by itself expose another tenant’s data.
Three-layer audit logging	Every API request, database write, and application event is logged, with patient identifiers hashed and PHI redacted. Audit logs are retained for 10 years.
PHI protection	Patient IDs are hashed with HMAC-SHA256 (HIPAA Safe Harbor) before they touch any log. All 18 Safe Harbor identifiers are redacted before data reaches any LLM.
Strict access control	JWT bearer tokens, revocable tenant API keys, bcrypt password hashing, brute-force lockout, and role-based access control on every endpoint.
Incident response	A formal seven-phase IR plan with 15-minute acknowledgment for critical incidents, breach risk assessment per 45 CFR 164.402, and annual tabletop testing.

Data retention

**Table 3.** Retention period by data category.
Data category	Retention
Clinical records	6 years minimum (HIPAA)
Imaging metadata	7 years (ACR/CMS)
Audit logs	10 years, then encrypted S3 archive
Consent records	6 years from last activity

Records are soft-deleted first: kept encrypted and available for regulatory inspection, but excluded from all API responses. On termination, tenants may request FHIR export or certified destruction within 30 days.

Incident response

**Table 4.** Acknowledgment time by severity.
Severity	Acknowledgment
Sev 1: Critical	15 minutes
Sev 2: High	30 minutes
Sev 3: Medium	2 hours
Sev 4: Low	Next business day

Covered-entity notification within 72 hours of a confirmed breach; HHS notification within 60 days. The plan is exercised annually through tabletop drills and technical tests.

Subprocessors

**Table 5.** Subprocessors and their access to PHI.
Subprocessor	PHI access
Amazon Web Services	Yes: stores ePHI (AWS BAA)
Stripe	No: billing metadata only
LLM providers (configurable)	Limited: redacted context only

Enterprise customers can use self-hosted models to eliminate external PHI transmission entirely.

Shared responsibility

**Table 6.** Who is responsible for what.
Party	Responsibilities
We handle	Infrastructure, encryption, tenant isolation, audit logging, incident response, and the BAA.
You handle	User management, credential security, workforce training, and minimum-necessary data submission.
Together	Breach notification, patient notices, and state-specific requirements.

Documents and contact

Every safeguard is mapped to the HIPAA Security Rule in our security whitepaper. We sign a Business Associate Agreement with every customer.

Request the security whitepaperSafeguards mapped to the HIPAA Security Rule
Request the BAABusiness Associate Agreement for your review
security@nanosense.netSecurity questions and vulnerability reports

Request access