HIPAA-compliant healthcare quality analytics with comprehensive security safeguards. Choose your deployment model based on your compliance requirements.
Choose the deployment model that aligns with your compliance requirements and timeline
On-Premise / VPN Deployment
No BAA Required
Customer maintains full data control
Data Stays On-Premise
PHI never leaves your infrastructure
Maximum Security Control
You control access, backups, and encryption
Faster Procurement
Software purchase, not BAA negotiation
Best For:
Cloud SaaS Deployment (Future)
BAA Required
We become your business associate
HITRUST Certification
Comprehensive security framework validation
SOC 2 Type II Compliance
Independent security audit and attestation
Best-in-Class Cloud Security
Enterprise-grade infrastructure and monitoring
Best For:
Building toward best-in-class cloud compliance
Our platform implements all required HIPAA security measures across administrative, physical, and technical domains
Essential steps for maintaining HIPAA compliance with on-premise deployment
Conduct Risk Assessment
Identify and document potential security risks
Review Security Policies
Update policies to include HEDIS platform
Prepare Infrastructure
Secure server environment, network isolation
Train Workforce
HIPAA security awareness for all users
Configure Encryption
Enable database and file system encryption
Verify Security Controls
Test authentication, encryption, logging
Configure Audit Logging
Enable comprehensive access logging
Implement Backup Strategy
Daily encrypted backups with offsite storage
Document Configuration
Maintain detailed system documentation
Schedule Regular Reviews
Quarterly access reviews, annual risk assessments
Monitor Access Logs
Review audit logs weekly for anomalies
Apply Security Updates
Patch systems within 30 days
Test Backups
Monthly restore testing
Review User Access
Quarterly access certification
Maintain Documentation
Keep policies and procedures current
Establish Procedures
Document incident response plan
Define Breach Notification
60-day notification process
Conduct Regular Drills
Annual incident response testing
Maintain Contact List
Escalation and notification contacts
Document All Incidents
Detailed incident logs and lessons learned
Schedule a security review with our compliance team to discuss your specific requirements