Security & Compliance
Audit-Ready by Design
At Podero Health, we align with industry-standard frameworks to ensure data is handled securely and audit-ready. Our safeguards cover administrative, technical, and physical controls. These include compliance with HIPAA, execution of BAAs with all clients, and a roadmap toward SOC 2 certification by 2026 — each represented below.
HIPAA Compliant
Full compliance with HIPAA Privacy and Security Rules
BAA Executed
Business Associate Agreements signed before PHI exchange
SOC 2 In Progress
Expected certification in 2026
HIPAA & BAA in place today. SOC 2 certification expected 2026.
HIPAA compliance independently validated by Clearwater Compliance (external auditor). SOC 2 audit in progress (2026).
Security Controls
Multi-layered protection for your most sensitive data.
Data Encryption
- AES-256 encryption at rest
- TLS 1.2+ in transit
- Encrypted backups with key rotation
- Database-level encryption with separate key management
Access Controls
- Least-privilege model for all team members
- Multi-factor authentication (MFA) required
- Role-based access control (RBAC) for data segmentation
- Quarterly access reviews and certifications
Infrastructure & Hosting
- Hosted on SOC 2-certified cloud infrastructure (AWS/GCP) with U.S. data centers
- 99.9% uptime SLA with automated failover
- Continuous backups with point-in-time recovery
- Network segmentation and firewall protection
Audit & Monitoring
- Immutable audit trails for all data access
- Real-time alerting for suspicious activity
- Log retention for 7 years
- Quarterly security reviews by third-party auditors
Incident Response
- 24/7 security monitoring and alerting
- Documented incident response plan, tested quarterly
- HIPAA-compliant breach notification procedures
- Dedicated security team with healthcare expertise
Data Retention & Disposal
Configurable policies that align with your compliance requirements.
Medical Records
Default 7 years, extendable up to 10 years per HIPAA/state requirements.
Audit Logs
Immutable, retained for 7 years.
Project Files & Deliverables
Retained through the audit cycle (typically 18–24 months) or per plan policy.
Secure Disposal
Data deleted per NIST 800-88 standards. Cryptographic erasure ensures data cannot be recovered. Certificate of destruction available on request.
Questions About Security?
At Podero Health, security is built into every step of our platform. We follow HIPAA standards, enforce strict access controls, and maintain audit trails across all data flows. While SOC 2 certification is on our roadmap, our current practices already align with SOC 2 control areas.