HIPAA safeguards
ArkCloud implements technical safeguards designed to support the HIPAA obligations of a covered entity or business associate, and a BAA is agreed with each customer during contracting. This page describes those safeguards and names the administrative ones that are not yet in place. There is no HIPAA certification to hold, and none is claimed.
Last Updated: October 1, 2026
How to read this page
ArkCloud acts as a Business Associate when it processes Protected Health Information (PHI) on behalf of a covered entity. Each safeguard below is described as narrowly as the evidence for it supports.
HIPAA compliance is shared. The covered entity remains responsible for its own policies, workforce and use of the system. Where an administrative safeguard is not yet in place on our side, this page says so rather than describing a programme that does not exist.
1. Technical Safeguards
Encryption
Data protection at rest and in transit
- AES-256-GCM field-level encryption for designated PHI fields; the database volume itself is not encrypted
- TLS 1.2 or later for public traffic, with HSTS; the application is reached from the edge through an encrypted tunnel
- Database backups are not yet encrypted
- Keys are supplied by the server environment, not stored with the data. There is no KMS or HSM and no rotation schedule
Access Controls
Secure authentication and authorization
- Multi-factor authentication required for administrator roles, available to every user
- Role-based access control, checked server-side
- Cross-tenant operator access only for explicitly allowlisted users; the list is empty by default
- Sessions end after an absolute 8 hours (30 days only if the user opts in)
- Account locked for 15 minutes after 10 failed sign-ins
Audit Logging
Activity tracking
- Reads, updates and exports of PHI logged separately from application events
- Hash-chained security audit log, so a deleted, re-ordered or (for entries from 2 October 2026) edited entry is detectable
- Sign-in success and failure, lockout and privilege changes recorded
- No real-time security monitoring or automated anomaly alerting is in operation yet
Network Security
Edge and host
- Public traffic passes through Cloudflare, whose network provides DDoS mitigation
- Host firewall enabled; the application is reached from the internet through an outbound tunnel
- No intrusion detection system, and no network segmentation beyond the host firewall
- No scheduled vulnerability scanning of the production environment yet
- No penetration test has been performed
2. Administrative Safeguards
Security Management Process
- In place: audit and PHI access logs that can be reviewed during an investigation
- Not yet in place: a documented HIPAA risk analysis, a risk-management plan, a written sanction policy, or a scheduled log-review cadence
Workforce Security
- In place: tenant administrators assign roles and can deactivate a user, after which sign-in is refused
- Not yet in place: background checks or workforce clearance procedures, a written termination procedure, or periodic access recertification
Contingency Planning
- Data Backup: an automated nightly database backup, each one checked readable when written and retained for 14 days. Backups are not yet encrypted and not yet copied off the host
- Disaster Recovery: a written plan exists for the cloud deployment model; it has not been revised for the current deployment; one full restore from backup was rehearsed on 1 October 2026 and completed without errors; regular restore testing is not yet scheduled
- Not yet in place: emergency-mode operating procedures, or a schedule for testing contingency plans
3. Physical Safeguards
Facility Access Controls
ArkCloud is delivered only as a hosted service; running it on infrastructure you control is not offered (see the licensing page). Physical safeguards for the hosting facility are therefore our responsibility. We will name the hosting facility and its physical controls in writing, on request, rather than summarising them here.
Workstation and Device Security
No written workstation, device or media-disposal standard exists yet. The workstations and devices your own staff use to access the service remain your responsibility.
4. Business Associate Agreements
ArkCloud offers a Business Associate Agreement (BAA) to covered-entity customers. The BAA template includes:
- Detailed description of permitted uses and disclosures of PHI
- Commitment to implement appropriate safeguards
- Agreement to report security incidents and breaches
- Provisions for subcontractor BAAs when applicable
- Terms for PHI access, amendment, and accounting of disclosures
- Procedures for PHI return or destruction upon contract termination
The BAA requires any subcontractor that handles PHI on our behalf to accept the same restrictions. No list of subprocessors that handle PHI, or of the BAAs executed with them, is published yet; ask the security team before relying on one.
5. Breach Notification Procedures
When a breach of PHI is suspected or confirmed, ArkCloud commits to the following steps:
1. Detection and Assessment
Immediate investigation to determine the nature and scope of the incident
2. Containment
Swift action to contain the breach and prevent further unauthorized access
3. Notification
Notification to affected covered entities within the timeframe the BAA sets, and in any case no later than 60 days after discovery
4. Documentation
Detailed documentation of the incident, response actions, and mitigation measures
5. Remediation
Implementation of corrective actions to prevent future incidents
A written breach-notification procedure has not been completed yet, and no incident-response exercise has been run.
6. Workforce Training
No HIPAA workforce training programme is in place yet, and no training records exist. Until there is one, this page will not describe one.
7. Risk Assessments
Where risk assessment stands today:
- No formal HIPAA risk analysis has been completed and documented.
- No third-party security assessment or penetration test has been performed.
- Dependency, secret and container scanning are defined in the CI pipeline, but they do not yet gate releases to the production server, and no scheduled scan of the production environment exists.
8. Documentation and Policies
What exists in writing today, and what does not:
Written today
- Business Associate Agreement template
- Incident runbook for operational outages
- Disaster-recovery plan for the cloud deployment model
- Data-retention rules, configured in the application
- Audit and PHI access logs
Not yet written
- HIPAA security and privacy policies
- Risk analysis report
- Breach-notification procedure
- Workforce training records
9. Certification and Attestation
Certification posture
ArkCloud Health holds no security certification today. The current state:
- No HITRUST certification is held
- No SOC 2 report is held, and no audit has been engaged yet
- No HIPAA certification exists for a software product, and none is claimed
Shared responsibility
Using ArkCloud does not, on its own, meet an organization's HIPAA obligations. The covered entity remains responsible for its own risk analysis, policies, workforce training and use of the system; the safeguards on this page support that work and do not replace it.
10. Contact for HIPAA Inquiries
For questions about these safeguards, to report a security incident, or to request a Business Associate Agreement, please contact:
HIPAA and security inquiries
Email: [email protected]
Security Incidents: [email protected]
For urgent security incidents, email the security address above and mark the subject URGENT. There is no 24-hour telephone hotline, and saying there was one would send someone reporting a breach to a number nobody answers.
This page describes the safeguards ArkCloud implements today and names the ones not yet in place. It is not a certification.