The highest-security path — designed from day one.
The items below are our engineering design targets. Final control mappings and authorizations are validated per engagement against your contract, data types, hosting authorization, and legal/security review.
Encryption in Transit & At Rest
TLS 1.2+ transport; storage encryption for documents and database fields containing PHI/PII.
Role-Based Access & Least Privilege
Role separation across admin, staff RN, attorney/VA-accredited, and client scopes.
MFA-Ready Authentication
JWT-based authentication with an MFA-ready schema for step-up requirements.
Data Segregation
Separate handling of PHI, PII, VA-related information, and potentially CUI.
Comprehensive Audit Logs
Immutable audit trail of authentication, access, uploads, downloads, and mutations.
Federal-Cloud-Ready Architecture
Deployment path capable of operating in appropriately authorized federal cloud services.
Incident Response & Review
Documented response procedures with post-incident review and corrective-action tracking.
Retention & Disposal Controls
Configurable retention with deliberate disposal aligned to contractual obligations.
Design-target framework mapping
Not certifications — engineering intent, subject to validation.
| Framework | Control focus |
|---|---|
| HIPAA Security Rule | Access control, audit controls, integrity, transmission security |
| NIST 800-171 Rev. 3 | Access control, audit & accountability, identification & authentication, media protection, system & communications protection |
| CMMC (Draft Alignment) | Level 2 practices where CUI is present |
| CUI Handling | Marking, safeguarding, transmission, and destruction procedures |
| DOD Requirements | Contract-driven; mapped where the engagement dictates |
DISCLAIMER — DESIGN TARGETS REQUIRING VALIDATION AGAINST CONTRACTS, DATA TYPES, HOSTING AUTHORIZATION, AND LEGAL/SECURITY REVIEW.