IncidentPath is built ground-up for HIPAA-covered entities. Every request that touches protected health information (PHI) leaves an audit trail. Every field is encrypted at rest. Every session is bound to a device you can revoke in one click. No dark patterns. No selling data. No exceptions.
Aligned with
HIPAA Security Rule
45 CFR §164.302–318
HIPAA Privacy Rule
45 CFR §164.500–534
HITECH Breach Notification
45 CFR §164.400–414
CMS Emergency Preparedness
42 CFR §418.113
The controls
Not a marketing checklist. These are the concrete controls implemented in the code, reviewed on every deploy, and provable in the audit log.
TLS 1.3 on the wire. AES-256 for MongoDB storage. All backups encrypted with a separate KMS-managed key. Every field that touches PHI is encrypted before it ever hits disk.
TLS 1.3 · AES-256-GCM · KMS-managed keys
Your session token lives in an httpOnly, Secure, SameSite=Lax cookie — never exposed to JavaScript, never stored in localStorage. XSS can't grab it. CSRF is blocked by a double-submit token pattern on every state-changing request.
httpOnly + Secure + SameSite=Lax · double-submit CSRF
Every route enforces role (staff / supervisor / admin / super_admin) AND organization scoping. A supervisor at Hospital A can never see incidents at Hospital B, even if they guess the URL. Enforced at the router, not the UI.
Route-level RBAC · org tenant isolation
Every read of a PHI field (patient name, room, MRN, description) is logged with who / when / from what IP / which field / why. Immutable, append-only, retained per your policy — 7 years by default.
phi_audit_logs collection · append-only
Optional TOTP or SMS 2FA for any account. Required by policy for admin and super_admin. Recovery codes generated at enrollment. Session cookies bound to the 2FA-verified device.
TOTP + SMS · policy-enforced for admins
One dedicated MongoDB collection per tenant type. No cross-tenant queries possible. US region only by default. Your PHI never leaves the US, never enters a non-BAA vendor's environment, never feeds a model outside our BAA chain.
US-only · single-tenant collections
Image analysis and text extraction route through OpenAI's BAA offering via our Emergent BAA chain. GPT-5.2 vision never trains on your data. If a provider ever loses BAA coverage, the analyzer fails closed — better an empty extract than a leak.
OpenAI (BAA-covered) · fail-closed on BAA gap
A single button files a breach report against the HITECH 45 CFR §164.404-408 deadlines. The system calculates HHS notification requirements (500-record rule), pre-fills the incident summary, and starts the 60-day clock.
45 CFR §164.404-408 · 60-day clock
No shared credentials. Each backend service uses its own scoped service account. No developer can `mongo shell` into prod without SSO + admin approval + a session recording. Every prod query is logged.
Scoped service accounts · session recording
Sessions expire after 30 minutes of inactivity by policy default (configurable per org, per role). Concurrent-session termination is one click from the HIPAA compliance dashboard. Logout revokes every device at once.
Idle timeout · admin session kill switch
Strict CSP with per-request nonces. No inline scripts, no eval, no wildcard sources. Blocks a whole class of XSS, click-jacking, and third-party script attacks by default. Reported violations feed into the security posture dashboard.
Nonce-based CSP · report-only fallback
We publish security advisories with CVE numbers where applicable. Every high-severity fix ships with a written RCA and a test that prevents regression. See the internal audit findings F-1 through F-13 tracked in-repo.
Written RCA · regression test required
PHI audit
When a supervisor opens an incident, the fields they viewed are captured at the API layer — not by a middleware afterthought, but by the route handler itself. Admins can filter the audit log by user, patient, date range, or field. Exportable as CSV or PDF for compliance reviews.
{
"audit_id": "9c11...c8f2",
"user_id": "usr_a4d9...",
"user_role": "supervisor",
"org_id": "org_hospice_north_east",
"action": "read",
"resource_type": "incident",
"resource_id": "inc_20260724_0417",
"phi_fields_accessed": [
"patient_name",
"patient_room",
"description"
],
"reason": "incident_detail_view",
"ip_address": "203.0.113.42",
"user_agent": "Mozilla/5.0 ...",
"occurred_at": "2026-07-24T18:04:12Z"
}If something goes wrong
We take breach notification obligations seriously — for our platform and for yours. Here's what happens when we detect something anomalous.
Security posture dashboard flags anomalies (unusual PHI reads, geo mismatches, failed auth bursts). On-call gets paged.
Sessions revoked, affected accounts frozen, forensic snapshot taken. Root cause investigation begins.
If your data is materially affected, your designated privacy officer is contacted directly with a written incident summary.
If required by law (breach ≥ 500 records), we file HHS notification and support your organization's own reporting obligations.
We answer BAA, HIPAA, and security questionnaires directly — no back-and-forth through sales. Reach the security team below or start a live demo without a signup.
Install for quick access and offline incident reporting.