HIPAA
What healthcare teams should know first
Before you place health data on VxCloud
Please contact us before placing protected health information on VxCloud, so we can discuss what your use requires.
Overview
HIPAA sets US rules for protecting health information. A vendor that handles protected health information for a covered entity generally needs a Business Associate Agreement in place first.
Don't assume an agreement is in place unless you have signed one with us. The controls below are in the product today, and you remain responsible for how your own workloads are configured.
What's included
Production-grade capabilities, ready to enable in your workspace.
Multi-factor authentication
Accounts can require a time-based one-time code at sign-in.
OAuth sign-in
Sign in with an existing identity provider account instead of another password.
Secrets in HashiCorp Vault
Credentials are kept in Vault rather than in application configuration.
Audit console
Activity is recorded so it can be reviewed later, behind an MFA check.
Encryption in transit
Public VxCloud endpoints are served over HTTPS.
Card data stays with providers
Card numbers for VxCloud billing are handled by Stripe and PayPal, not stored by us.
Frequently asked questions
Still have questions? Our enterprise team answers within one business day.
Contact us about your use case and we'll tell you what we can offer.
Related enterprise capabilities
Ready to move forward with HIPAA?
Talk to our enterprise team — we'll scope your requirements, map the right capabilities, and build a rollout plan tailored to your organization.