Regulatory standards
We implement a comprehensive framework to ensure the confidentiality and integrity of your Protected Health Information (PHI).
Zero-Access Encryption: All patient/client data is encrypted at rest and in transit. Under our "Zero-Access" model, clinical notes are only accessible to authorized clinicians. Allia cannot decrypt your records.
SOC 2 Type II Certified: Our internal operations are independently audited to verify adherence to the Trust Services Criteria: Security, Availability, and Confidentiality.
The "Minimum Necessary" Standard: Internal access is strictly limited. Information is only processed as required to deliver EHR services, preventing unnecessary data exposure.
Breach Notification: We maintain formal incident response protocols that adhere to federal notification requirements.
The chain of trust
Compliance is a shared responsibility. We ensure every link in our infrastructure is as secure as the core platform.
Sub-processor BAAs: We maintain signed Business Associate Agreements with all third-party vendors to ensure a secure, compliant chain of trust.
Practitioner BAAs: We provide a BAA to every clinician to formalize our commitment to your practice's compliance and data security.
To receive a signed Business Associate Agreement (BAA) for your HIPAA records, please email team@allia.health.
For technical questions about our security and privacy controls, contact support@allia.health.