Encryption in transit
TLS 1.3 preferred, TLS 1.2 minimum. No unencrypted HTTP in production. HSTS pinned.
HIPAA from line 1
PHI deserves more than a lock icon
Every byte encrypted. Every access logged. Built on Google Cloud HIPAA-eligible services.
Compliance
Where we stand today
Control
Status
Notes
- HIPAALivePrivacy + Security Rules
- Business Associate Agreement (BAA)LiveAvailable for every customer
- GCP HIPAA BAA (cloud provider)LiveCloud SQL, GCS, Secret Manager, Compute
- State breach notification (50 states + DC)LiveTracked by the Privacy Officer
Technical controls
Defense in depth
Encryption at rest
AES-256 across Cloud SQL, GCS, and every backup. Google Cloud KMS. Customer-managed encryption keys on request.
Authentication
Unique user identity with no shared logins. Strong-password policy. MFA available for all users and required for admin roles.
Role-based access
Pundit policies enforce minimum-necessary access to ePHI. Granular role flags are configured by practice administrators.
Operational controls
People + process, not just code
- Workforce HIPAA training within 30 days of hire and annually thereafter.
- Incident response plan with named Security Officer and Privacy Officer.
- Breach notification within 60 days of discovery per the HIPAA Breach Notification Rule.
Sub-processors
Who else touches your data
Vendor
Purpose
Safeguard
- Google Cloud PlatformHosting, database, object storage, KMSHIPAA eligible
- TwilioVoice + SMS for AI frontdesk + appointment remindersHIPAA eligible
- DocuSeal (self-hosted)Consent + intake signing on our VMSelf-hosted
- ResendTransactional email; no PHI in subject linesTransactional
- StripePatient paymentsPCI DSS (no PHI)
We notify customers 30 days before adding a new sub-processor that handles ePHI. Questions go to security@enwella.com.
Documents
Take it with you
Business Associate Agreement (PDF)Pre-signed template - return to security@enwella.com to execute.
Security one-pager (PDF)Procurement-ready summary of encryption, access, audit, and incident response.
Privacy PolicyHow we collect, use, and protect personal information.
Data Security & Breach Notification PolicyFull administrative, physical, and technical safeguards.
Have a question we did not answer?
Email our Security + Privacy Officers directly. Most replies arrive within one business day.