HIPAA compliance is woven into Harper’s DNA. Explore the safeguards, procedures, and evidence that prove we protect electronic protected health information at every layer—from governance to infrastructure and day-to-day operations.
Controls across governance, privacy, security, and resilience.
Mandatory HIPAA safeguards implemented and monitored.
Tailored safeguards with documented rationale and outcomes.
We anchor our privacy and security program with clear governance, accountable owners, and documented processes that stay aligned with the HIPAA Privacy, Security, and Breach Notification Rules.
We document where Harper serves as a Business Associate versus a Covered Entity and maintain detailed architecture diagrams that trace every stream of ePHI across our platform.
Named leaders hold written charters that outline their responsibilities for day-to-day operations, policy oversight, and board reporting.
Our policy set spans Privacy, Security, Breach Notification, sanctions, vendor governance, BYOD, telehealth, and remote work with formal version control and annual review cycles.
We maintain a living catalog of applications, services, vendors, and data stores, each tagged with the ePHI elements it touches and supporting data flow diagrams.
Employees and customers can raise privacy or security concerns through multiple channels; every submission is tracked to closure with a strict non-retaliation stance.
We run a quarterly scorecard that covers incident trends, training completion, vendor reviews, backup verification, and risk remediation progress.
Recurring tasks such as risk analysis, tabletop exercises, policy attestations, and BAA audits are scheduled, owners assigned, and completion evidenced.
Administrative controls ensure we identify, assess, and manage risks to ePHI with clear accountability across the workforce and our partners.
We perform an enterprise risk analysis at least annually and whenever major changes occur, cataloging threats to ePHI across infrastructure, applications, and people.
Mitigation plans are prioritized, funded, and tracked through closure with dashboards for leadership review.
Workforce disciplinary guidelines are documented, acknowledged, and enforced when privacy or security obligations are breached.
Security, privacy, and engineering leads jointly review audit logs, access reports, and incident metrics on a defined cadence.
A single accountable security official oversees the HIPAA program and reports progress to executive leadership.
We enforce least-privilege onboarding, periodic access reviews, and tightly scripted offboarding procedures for every role.
Role-based access controls, ticketed provisioning, and documented approvals govern all ePHI systems, including clearinghouse isolation when required.
Harper employees complete initial and annual HIPAA training, phishing simulations, and targeted modules for engineering and support teams.
Our incident response plan covers detection, escalation, containment, forensics, notifications, and retrospective learning with full documentation.
We maintain and test our ability to safeguard ePHI during service disruptions with documented response and recovery playbooks.
Automated backups are encrypted, verified daily, and replicated to a secondary region with restore drills at least twice a year.
Runbooks define RTO/RPO targets, failover procedures, and communication templates for extended outages.
We prioritize critical clinical workflows under emergency conditions to ensure patients and clinicians maintain access to essential information.
Tabletop and technical DR exercises feed improvement back into our documentation and automation.
Business impact assessments rank each system handling ePHI so recovery sequencing reflects real-world priorities.
We conduct annual security and privacy program evaluations to validate safeguards and adjust to new threats or business changes.
All vendors with ePHI access execute BAAs, undergo due diligence, and maintain downstream assurances for subcontractors.
Policies, procedures, risk analyses, training records, and incident logs are retained for no less than six years.
Physical controls protect our workplaces, workstations, and media wherever ePHI could be accessed or stored.
We operate within secured facilities, enforce badge-based entry, maintain visitor logs, and define contingency operations for alternate sites.
Acceptable use requirements cover physical placement, privacy screens, and authorized functions for devices handling ePHI.
All corporate endpoints use disk encryption, auto-lock, cable locks or secure rooms, and centralized device management.
Hardware containing ePHI is tracked end-to-end and sanitized or destroyed under strict procedures before reuse or disposal.
We follow NIST SP 800-88 Rev.1 guidance for crypto erase, shredding, or degaussing as applicable.
Any device slated for repurpose undergoes verified data sanitization before leaving secure custody.
Asset inventories record device custody, chain of possession, and attestation of sanitization.
Before relocation or maintenance, we create secure, retrievable copies of data to prevent accidental loss.
Technical controls embed security directly into our platform, ensuring only the right people and systems can access ePHI.
Authentication, authorization, and session governance policies are enforced across every Harper environment.
No shared accounts—each user has a unique ID tied to least-privilege roles and auditable approvals.
Break-glass workflows grant temporary elevated access with justifications, logging, and post-event review.
Session timeouts, device lock policies, and MDM controls reduce exposure from unattended devices.
ePHI is encrypted in transit (TLS 1.2+) and at rest using centrally managed keys with rotation schedules.
Centralized logging with immutable storage and clock synchronization captures access to ePHI and supports forensic investigations.
Checksums, signed logs, and tamper-evident storage detect unauthorized changes to critical data.
Strong authentication—including MFA for administrators and remote access—is enforced with no shared credentials.
We prevent interception or tampering of ePHI during transmission across our services and partner integrations.
Transport protocols leverage TLS, HSTS, and certificate management with continuous monitoring for downgrade attempts.
Plaintext protocols are disabled; all APIs, messaging, and storage replication flows require modern encryption.
We hardwire contractual obligations and documentation practices that stand up to audits and demonstrate accountability.
Every vendor with ePHI exposure signs a BAA detailing permitted uses, safeguards, breach notice timelines, and subcontractor flow-down clauses.
Written policies live in a centralized repository with versioning, approvals, and change management triggered by environmental shifts.
Documentation—including risk analyses, BAAs, training records, and incident reports—is retained for at least six years from last effective date.
Privacy principles shape how we collect, use, disclose, and safeguard PHI for individuals and families using Harper.
Access and disclosures are limited to the least amount of PHI required to achieve the intended purpose.
Treatment, payment, and healthcare operations activities are documented so permitted uses do not require additional authorization.
We capture, track, and honor individual authorizations for non-TPO use cases and retain documentation of revocations.
Our NPP reflects actual practices, is delivered to users, and is posted online with revision history.
Requestors must verify identity and authority before PHI is disclosed.
Processes exist to deliver access, amendments, disclosure accountings, and confidential communication preferences within regulatory timelines.
Individuals can receive electronic copies of their PHI promptly through secure channels.
Requests to amend PHI are evaluated, documented, and appended with statements of disagreement when denied.
Non-TPO disclosures are logged and can be produced on demand.
We honor reasonable requests for alternate contact methods and required restrictions when services are paid out-of-pocket.
Special rules are applied with legal review, including consideration of de-identified or limited data set options with DUAs.
Any improper use or disclosure triggers mitigation steps and corrective actions.
Privacy obligations are part of onboarding, annual refreshers, and disciplinary processes for violations.
Stricter federal and state requirements—such as 42 CFR Part 2 for SUD records—are layered into system controls as applicable.
Individuals have clear channels to submit privacy complaints and we prohibit retaliation for doing so.
Prepared playbooks ensure swift decision-making, communication, and documentation for any suspected breach of unsecured PHI.
Each incident undergoes a documented risk assessment addressing data sensitivity, unauthorized parties, likelihood of access, and mitigation.
We align encryption and destruction standards with HHS guidance to minimize scenarios that require notification.
When required, affected individuals are notified without unreasonable delay and no later than 60 days with all mandated content.
We report breaches affecting 500 or more individuals within 60 days and log smaller incidents for annual submission.
If an incident impacts 500+ residents in a jurisdiction, we coordinate timely media notifications.
Business Associates must notify us promptly with all relevant details so we can meet our obligations.
All assessments, decisions, notifications, and remediation steps are retained for at least six years.
We extend HIPAA safeguards to every partner that touches ePHI through rigorous onboarding, oversight, and offboarding controls.
Every service provider that creates, receives, maintains, or transmits ePHI is cataloged and covered by an executed BAA, including downstream obligations.
Security questionnaires, certifications (SOC 2, HITRUST), and control validations inform onboarding decisions.
Vendors receive the minimum necessary access, and analytics or telemetry tools are only enabled when contractual protections and documented need exist.
Access is terminated promptly at contract end and vendors must attest to data return or destruction.
Cloud-native guardrails ensure our infrastructure stays hardened, observable, and resilient against evolving threats.
Managed keys reside in hardened KMS/HSM services with separation of duties and rotation policies.
TLS is enforced end-to-end with deprecated ciphers disabled and private connectivity options for internal services.
MFA, least-privilege IAM roles, periodic access reviews, and break-glass accounts protect our cloud tenants.
Logs aggregate centrally with alerting for anomalous access and long-term immutable storage.
Regular patch cycles, automated scanning, and penetration tests feed our remediation backlog.
EDR, anti-malware, and full-disk encryption are enforced on all laptops with MDM for BYOD controls.
Segmentation, WAF policies, rate limiting, and DDoS protections safeguard public and internal interfaces.
Application secrets live in vaulted stores with rotation automation—never in code repositories.
Code review, dependency scanning, SAST/DAST, and infrastructure-as-code guardrails are embedded into our pipelines.
Backups are automated, encrypted, and replicated across regions with periodic restore testing.
Retention schedules, deletion workflows, and NIST 800-88 aligned sanitization cover the full data lifecycle.
Approved devices, secure Wi-Fi/VPN usage, and hardening standards support our distributed workforce.
We embrace data minimization principles so innovation never outpaces privacy protections.
Whenever feasible, secondary use cases rely on Safe Harbor or Expert Determination techniques to remove identifiers.
When de-identification is not practical, limited data sets are paired with executed Data Use Agreements.
Internal and external disclosures are scoped to the least amount of data required.
Our people are our front line—ongoing education and accountability keep privacy and security top of mind.
Every workforce member completes HIPAA and security training when hired and annually thereafter, with specialized paths for technical staff.
We run regular phishing simulations, just-in-time education, and communications that reinforce emerging risks.
Access grants, NDA attestations, equipment assignment, and device return are all tracked through checklists.
Our disciplinary policy is exercised when expectations are not met, reinforcing the seriousness of HIPAA obligations.
Prepared responders, clear communications, and regulator-ready processes minimize impact when issues arise.
Roles, severity levels, forensic preservation, and communication workflows are defined and tested.
At least annually we run realistic tabletop scenarios and capture lessons learned.
Contacts with law enforcement, regulators, and communication partners are maintained with ready-to-send templates.
Feedback loops ensure our program evolves alongside technology, threats, and regulatory expectations.
Security and privacy leaders review program maturity, control effectiveness, and regulatory alignment at planned intervals.
We audit policy adherence, entitlement reviews, and log monitoring to confirm controls are operating as intended.
Executives receive dashboards tracking open risks, time to patch, incident MTTR, and training completion.
Even before rulemaking is finalized, we are adapting to the 2025 HIPAA Security Rule NPRM to stay ahead of expectations.
Mandatory MFA, asset inventories, enhanced risk assessments, formalized incident response, vendor oversight, and network testing are already on our roadmap with owners assigned.
Comprehensive evidence backs every safeguard so we can demonstrate compliance for at least six years.
Policies, BAAs, data maps, risk analyses, remediation plans, training logs, access reviews, audit log reviews, incident records, breach notifications, backup and DR tests, vendor assessments, media sanitization certificates, and audit reports are retained with clear ownership.
Our HIPAA program is continuously audited, improved, and backed by executive oversight. Need more detail? Reach out to our privacy team for policy copies, audit reports, or to schedule a security review.
Contact our privacy team
