HIPAA Security Overview

1. Introduction

Flowtrics, LLC (“Flowtrics,” “we,” “us,” or “our”) is committed to safeguarding the confidentiality, integrity, and availability of electronic protected health information (ePHI) in accordance with the Health Insurance Portability and Accountability Act (HIPAA) Security Rule (45 C.F.R. Parts 160 and 164, Subparts A and C). This policy outlines the administrative, physical, and technical safeguards we maintain to protect ePHI that we create, receive, maintain, or transmit on behalf of our clients.

This document is intended for clients, partners, workforce members, and other stakeholders who wish to understand Flowtrics’ security practices. It does not constitute legal advice. Clients should consult their own counsel to ensure compliance with all applicable regulations.

2. Scope

This policy applies to all Flowtrics workforce members (employees, contractors, and interns), systems, applications, and third‑party services that process ePHI.

3. Key Definitions

  • Electronic Protected Health Information (ePHI): Individually identifiable health information transmitted or maintained in electronic form.
  • Business Associate: An entity that creates, receives, maintains, or transmits ePHI on behalf of a covered entity.
  • Regulated Entity: A covered entity or business associate subject to HIPAA.

4. Regulatory Framework

The HIPAA Security Rule requires regulated entities to implement reasonable and appropriate safeguards to:

  • Ensure the confidentiality, integrity, and availability of ePHI.
  • Protect against reasonably anticipated threats or hazards.
  • Guard against impermissible uses or disclosures.
  • Ensure workforce compliance.

The Rule is intentionally flexible and technology‑neutral, allowing each regulated entity to select measures proportional to its size, complexity, and risk profile.

5. Administrative Safeguards

5.1 Security Management Process

  • Risk Analysis: We conduct an enterprise‑wide risk analysis at least annually and whenever significant system changes occur.
  • Risk Management: Identified risks are assigned owners, prioritized, and mitigated to an acceptable level.

5.2 Assigned Security Responsibility

Flowtrics has appointed a Chief Information Security Officer (CISO) who oversees the development, implementation, and enforcement of security policies.

5.3 Workforce Security & Training

  • Role‑based access is provisioned following the principle of least privilege.
  • Background checks are completed prior to employment.
  • Mandatory HIPAA and security awareness training is provided at hire and annually thereafter.
  • A documented sanction policy addresses violations of this policy.

5.4 Information Access Management

  • Access requests require management approval and are logged in our identity management system.
  • Quarterly access reviews verify appropriateness of privileges.

5.5 Security Incident Procedures

  • An Incident Response Plan (IRP) defines detection, containment, eradication, recovery, and post‑incident review.
  • All incidents are logged and reported to the CISO within one business day.

5.6 Contingency Planning

  • Daily encrypted backups are replicated to an off‑site region.
  • Disaster Recovery (DR) tests are performed semi‑annually.

5.7 Evaluation

We perform periodic technical and non‑technical evaluations to validate the effectiveness of security controls and to accommodate environmental or operational changes.

5.8 Business Associate Agreements (BAAs)

Flowtrics executes BAAs with all subcontractors who create, receive, maintain, or transmit ePHI on our behalf.

6. Physical Safeguards

  • Facility Access Controls: Production infrastructure is hosted in ISO 27001‑certified data centers requiring badge and biometric authentication.
  • Workstation Security: Workstations use full‑disk encryption, automatic screen‑lock after 10 minutes, and MDM enforcement.
  • Device & Media Controls: Portable media containing ePHI is prohibited; secure wiping is performed prior to device disposal.

7. Technical Safeguards

  • Access Control: Unique user IDs, role‑based access, and multi‑factor authentication (MFA) are required for all systems handling ePHI.
  • Audit Controls: Centralized logging captures user, system, and network events; logs are retained for a minimum of six years.
  • Integrity Controls: Cryptographic hashing verifies data integrity; file integrity monitoring alerts on unauthorized changes.
  • Authentication: OAuth 2.1 and SAML/SSO integrate with our identity provider to verify user identities.
  • Transmission Security: All data in transit is encrypted using TLS 1.3; unused insecure protocols are disabled.

8. Organizational Requirements

We maintain executed BAAs with covered entity clients and downstream vendors, specifying permitted uses and disclosures of ePHI, breach notification obligations, and subcontractor requirements.

9. Policies, Procedures, and Documentation

All security‑related policies and procedures are documented, reviewed annually, and retained for at least six years from the date of creation or last effective date, whichever is later.

10. Incident Response & Breach Notification

Suspected or confirmed breaches involving ePHI are investigated promptly. Consistent with HIPAA’s Breach Notification Rule, Flowtrics will notify affected covered entities without unreasonable delay and no later than 60 calendar days after discovery.

11. Alignment with Pending Regulatory Updates

In January 2025, HHS issued a Notice of Proposed Rulemaking (NPRM) to strengthen cybersecurity requirements. Flowtrics is actively monitoring the rule‑making process and has begun implementing measures such as enforced MFA, enhanced vendor oversight, and annual compliance audits to align with the anticipated changes.

12. Compliance & Enforcement

Violations of this policy may result in disciplinary action, up to and including termination of employment or contract, and potential legal consequences.

13. Review & Revision

This policy is reviewed at least annually or whenever significant regulatory or operational changes occur.

14. Contact Information

Questions regarding this policy should be directed to:

Chief Information Security Officer
Flowtrics, LLC
Email: security@flowtrics.com