HIPAA Posture

Aarogentix handles Protected Health Information (PHI) and is built to support HIPAA-aligned operation. This page is the public-facing summary of our controls; the full internal document lives in our compliance repository.

Encryption in transit

  • TLS 1.2+ enforced at every ingress; HSTS on all subdomains.
  • Postgres connections require sslmode=require.

Encryption at rest

  • Managed Postgres (Neon) encrypts all data at rest with AES-256 via AWS KMS.
  • Highly sensitive PHI columns (insurance IDs, etc.) carry an additional field-level AES-256-GCM encryption using a per-environment ENCRYPTION_KEY.
  • Backups in S3 use SSE-AES256; bucket policy denies unencrypted uploads.

Access control

  • RBAC via decorator-enforced @Permissions(...) guards on every route.
  • Per-tenant isolation: organizationId is required on every query and integration-tested end-to-end.
  • JWT auth with refresh-token rotation (hashed, never stored plain). MFA (TOTP) available for staff accounts.
  • Account lockout after 5 failed login attempts (15-minute cooldown).

Audit logging

  • Every mutating route writes an immutable row to audit_logs. The table is enforced append-only by a database trigger that refuses UPDATE/DELETE/TRUNCATE.
  • Authentication events (login success/failure/lockout, logout, password change, password reset request/complete, MFA enable/disable/verify) are audited with IP + user agent.
  • Audit retention: 7 years per 45 CFR §164.316(b)(2).

Application-level safeguards

  • Input validation via class-validator DTOs on every endpoint.
  • Parameterized queries throughout (no string-built SQL).
  • Rate limiting via NestJS Throttler: 600 req/min/IP global, 10 req/min/IP on CSV exports.
  • Auth endpoints (login, register, reset) have stricter 2–10 req/min caps.
  • Boot-time validation refuses to start with placeholder secrets or a missing ENCRYPTION_KEY.

BAA

For US tenants subject to HIPAA, we sign Business Associate Agreements. Request via compliance@aarogentix.com.

Breach response

If PHI is exposed: contain (rotate credentials, revoke sessions); assess (scope, tenants, exfiltration); notify affected tenants within 72 hours per 45 CFR §164.404; postmortem documented; remediation tracked.