HIPAA-aligned safeguards

Physiogenic operates from Poland under GDPR. We are not a HIPAA "covered entity" or "business associate", but we voluntarily adopt the spirit of the HIPAA Security Rule (45 CFR §164.300 et seq.) as a higher bar for medical-data security. This document maps our controls to the three HIPAA safeguard families.

1. Administrative safeguards

• Access control — role-based (patient / clinician / admin). Every action gated by the role check is logged.
• Workforce training — annual GDPR + medical-data handling refresher for all clinic staff.
• Audit trail — every login, document download, and record edit writes an immutable row in the audit log (IP, user, timestamp, action).
• Incident response — 72-hour GDPR breach notification window; dedicated DPO contact.
• Business associate agreements — signed with all sub-processors handling identifiable health data.

2. Physical safeguards

• EU-region data centers — all databases and object storage hosted in EU (no transatlantic transfers of identifiable data).
• Provider compliance — sub-processors are ISO 27001 / SOC 2 certified.
• Workstation security — clinic devices require disk encryption + auto-lock after 5 minutes idle.

3. Technical safeguards

• Encryption in transit — TLS 1.3 for all client/server traffic; HSTS enforced.
• Encryption at rest — AES-256 for medical document storage; bcrypt for password hashes.
• Authentication — JWT access tokens + httpOnly cookies; optional TOTP 2FA for clinicians and admins.
• Authorization — every record query is scoped to the patient's user_id; cross-patient access requires audited admin role.
• Integrity — append-only audit log; document storage exposes ETag for tamper-evidence.
• Automatic logoff — 12-hour JWT lifetime (configurable down to 1 hour for high-security clinics).

4. Breach notification

In the event of a confirmed security incident affecting your personal or health data, we will notify you and the Polish supervisory authority (UODO) within 72 hours of discovery, per GDPR Article 33.

5. Your access rights

You can review, download, and request correction or deletion of your medical records at any time from your patient profile — same workflow as under GDPR.