How we protect patient and practice data

Information Security Policy

Last updated: December 2025

1. Purpose and Scope

This Information Security Policy establishes the framework for protecting information assets, including Protected Health Information (PHI) and Personally Identifiable Information (PII), within SaRA Health's technology platform and operations. This policy applies to all employees, contractors, vendors, and third-party service providers who have access to SaRA Health systems or data.

SaRA Health is committed to maintaining the confidentiality, integrity, and availability of all information assets in compliance with applicable regulations, including the Health Insurance Portability and Accountability Act (HIPAA) and the Health Information Technology for Economic and Clinical Health (HITECH) Act.

2. Information Security Governance

2.1 Security Leadership

Security governance is overseen by the Chief Technology Officer (CTO) in collaboration with engineering leadership and external security best practices. The CTO is responsible for managing the cybersecurity program and ensuring compliance with this policy.

2.2 Security Framework

Our security posture is built on a defense-in-depth approach, using multiple layers of security controls at the infrastructure, application, and operational levels. We rely on Aptible's HIPAA-compliant, SOC 2 Type 2, and HITRUST-certified infrastructure platform, which provides comprehensive security controls and documentation.

3. Infrastructure Security

3.1 Cloud Infrastructure

SaRA Health's platform is hosted on Aptible's managed cloud infrastructure, which operates on Amazon Web Services (AWS) infrastructure located exclusively within United States data centers. All infrastructure components are deployed in dedicated, isolated environments that are not shared with other tenants.

Key Infrastructure Security Controls:

• Network Segmentation: Dedicated VPC-based stacks with private subnets isolating application, database, and cache layers
• Network Firewalls: Deny-by-default policies with allow-by-exception rules, regularly reviewed and updated
• Web Application Firewalls (WAF): Protection against OWASP Top 10 vulnerabilities, SQL injection, cross-site scripting, and other web application attacks
• Intrusion Detection and Prevention: Host-based intrusion detection (HIDS) on all endpoints and network-based intrusion detection monitoring traffic patterns
• DDoS Protection: VPC-based architecture with Application Load Balancers that filter invalid requests
• Physical Security: Managed by AWS and Aptible, including 24/7 security monitoring, biometric access controls, and video surveillance

3.2 High Availability and Disaster Recovery

• Multi-Availability Zone Deployment: Application and database containers distributed across separate AWS availability zones
• Database Replication: PostgreSQL databases with replication and clustering across multiple availability zones
• Automated Backups: Daily incremental backups and weekly full backups, all encrypted
• Cross-Region Backups: Encrypted backups stored in physically secure remote locations
• Backup Testing: Regular testing to verify media reliability and data integrity
• Zero-Downtime Deployments: New containers are verified before old containers are terminated

4. Data Protection

4.1 Encryption

Data in Transit:

• All data transmission occurs over TLS 1.2 or higher protocols
• FIPS-validated cryptographic mechanisms for all communications
• HTTPS required for all web application access
• SSL/TLS endpoints with weak ciphers disabled by default
• Encrypted administrative access through SSH with MFA

Data at Rest:

• PostgreSQL databases encrypted at the filesystem level using AES-256 encryption
• Encryption keys managed securely by Aptible with proper access controls and key rotation
• All backups encrypted using the same encryption standards
• Database rekeying capabilities available when needed

4.2 Data Segregation

• Customer data is logically isolated at the application level
• Role-based access controls ensure users can only access data for their own organization
• Database access controls prevent cross-organization data access
• Comprehensive audit logging tracks all data access to ensure segregation is maintained

4.3 Data Loss Prevention

• Network-level controls that restrict data flow and enforce access policies
• Application-level access controls with role-based permissions
• Audit logging that tracks all data access and modifications
• Database access controls preventing unauthorized data access
• Encryption at rest and in transit

5. Access Management

5.1 Authentication

• Multi-Factor Authentication (MFA): Required for all internal employees and contractors accessing systems through Aptible's bastion host
• Single Sign-On (SSO): Support for SAML 2.0 protocol with identity providers including Auth0 and OneLogin
• Password Authentication: Standard username/password authentication with password complexity requirements
• JWT Tokens: Secure token-based authentication for API access with configurable expiration (currently 8 hours)

5.2 Authorization

• Role-Based Access Control (RBAC): Primary access control mechanism with roles defined for providers, administrative staff, and system administrators
• Access Control Lists: Additional restrictions for specific resources
• Individually Provisioned Permissions: Fine-grained control when needed
• Separation of Duties: Enforced through role structure (e.g., users who create billing records cannot approve them without additional permissions)
• Privileged Access Management: Elevated permissions granted only when necessary and logged for audit purposes

5.3 User Administration

• Formal user administration process through Django-based administrative interface
• All user administration activities logged through audit logging system
• Access restricted to authorized administrative personnel
• User roles clearly defined with specific permissions aligned with job functions
• Principle of least privilege applied

5.4 Access Reviews

Access reviews are conducted on an ad-hoc basis, typically triggered by role changes, employee departures, or security concerns. We are in the process of formalizing periodic access reviews as part of our ongoing security program improvements.

6. Network Security

6.1 Network Architecture

• Dedicated, isolated network environments (VPC-based stacks)
• Private subnets for application, database, and cache layers
• Public subnet limited to load balancers and bastion host
• Deny-by-default network policies with allow-by-exception rules

6.2 Network Access Controls

• Bastion Host: Secure gateway for administrative access requiring SSH with MFA
• Unused Port Disablement: Unused network ports disabled by default
• Network Access Control: Authentication required before network access is granted
• Secured Server Racks: All physical hardware housed in locked server racks and cabinets

6.3 Monitoring and Detection

• Host-based intrusion detection on all endpoints
• Network-based intrusion detection monitoring traffic patterns
• 24/7 security monitoring by Aptible's security team
• Immediate response to security events and anomalous activity

7. Application Security

7.1 Secure Development Practices

• OWASP Guidelines: Follow OWASP Top 10 security risks and incorporate security into code review process
• Secure Coding Practices: Input validation, output encoding, proper authentication and authorization, secure session management
• Vulnerability Protection: Protection against SQL injection, cross-site scripting, cross-site request forgery
• Dependency Management: Regular review of dependencies for known vulnerabilities, prioritized security updates

7.2 Change Management

• Code development in feature branches using Git version control
• Peer review through pull requests with security considerations
• Automated testing including unit tests, integration tests, and security checks
• Staging environment testing before production deployment
• Zero-downtime deployment processes

7.3 Source Control

• Commercial source control system (GitHub) with private repositories
• Appropriate access controls on repositories
• All code changes tracked and reviewed
• Infrastructure-as-code definitions stored in version control

8. Vulnerability Management

8.1 Vulnerability Scanning

• Automated vulnerability scanning performed monthly by Aptible
• Additional scans after new vulnerabilities are identified
• Application-level vulnerability scanning for dependencies
• Automated tools to identify vulnerable packages

8.2 Vulnerability Remediation

Vulnerabilities are classified by severity and remediated according to established timelines:

• Critical: Within 24 hours
• High: Within 7 days
• Medium: Within 30 days
• Low: Within 90 days

8.3 Patch Management

• Automated security patches via Ubuntu's unattended upgrades for routine updates
• Kernel patches and critical updates applied within timeframes dictated by severity
• Application-level patches tested in non-production environments before deployment
• Regular dependency updates and security patch management

9. Logging and Monitoring

9.1 Logging Capabilities

• Infrastructure Logging: Aptible's centralized logging captures all platform activity, access events, and system activities
• Application Logging: Django logging framework integrated with Sentry for error tracking and security event monitoring
• Audit Logging: Django auditlog integration tracks changes to critical models, logging who made changes, what was changed, and when
• Business Logic Logging: Logs capture EMR integration activities, SMS messaging events, and background task processing

9.2 Security Information and Event Management (SIEM)

• Aptible's platform activity logging provides SIEM capabilities
• Sentry integration for application-level security event monitoring
• Real-time alerts for security-related events
• Periodic manual log reviews for audit purposes and security investigations

9.3 Log Retention

• Infrastructure logs retained according to Aptible's policies
• Application logs maintained according to operational needs and compliance requirements
• Audit logs maintained for compliance and security purposes

10. Incident Response

10.1 Incident Response Process

• 24/7 security monitoring and incident response provided by Aptible for infrastructure-level events
• Established procedures for identifying, containing, and remediating application-level security issues
• Clear escalation paths to CTO and engineering leadership
• Communication channels for reporting security concerns

10.2 Breach Notification

• Processes for notifying affected parties in the event of a security incident involving PHI
• Compliance with HIPAA breach notification requirements
• Documentation and tracking of security incidents

11. Third-Party Risk Management

11.1 Vendor Evaluation

Before integrating with any third-party service that will handle PHI or have access to our systems, we evaluate:

• Security posture and compliance certifications
• Data handling practices
• Business Associate Agreement (BAA) requirements

11.2 Business Associate Agreements

We require Business Associate Agreements (BAAs) with all vendors that process PHI, including:

• Aptible (infrastructure)
• Twilio (SMS services)
• Azure OpenAI (AI functionality)
• Raintree Systems (EMR integration)

11.3 Vendor Monitoring

• Documentation of all third-party integrations
• Regular review of vendor security practices and compliance status
• Ongoing monitoring of vendor security posture

12. Artificial Intelligence and Machine Learning

12.1 AI Usage

SaRA Health utilizes Azure OpenAI's GPT models to personalize patient communication messages. The AI functionality enhances standard workflow questions with patient-specific context, encouragement based on progress, and personalized language.

12.2 Data Protection for AI

• Business Associate Agreement (BAA) in place with Azure OpenAI
• Customer data is kept completely separate from other clients' data
• Data processed in isolated sessions
• Customer data is not used for AI model training or any secondary purposes
• Azure OpenAI processes data according to BAA and does not use data for model training

12.3 AI Transparency and Monitoring

• Customers informed about AI enhancement feature during onboarding
• Feature can be enabled or disabled based on customer preference
• Providers can see in platform interface whether messages were generated using AI enhancement
• AI usage documented in system logs
• Monitoring of AI-generated content for quality and appropriateness

13. Endpoint Security

13.1 Managed Infrastructure Endpoints

• Host-based Intrusion Detection (HIDS) on all application container endpoints
• Monitoring for unauthorized access, rootkits, file integrity issues, and privilege escalation
• Automated security updates
• Hardened operating systems based on Center for Internet Security benchmarks

13.2 Employee Devices

• Security best practices for employee device management
• Regular software updates
• Secure authentication methods
• Access to production systems only through Aptible's secure bastion host with MFA

14. Physical Security

Physical security is managed entirely by Aptible and their underlying AWS infrastructure:

• AWS data centers housed in nondescript facilities
• Physical access strictly controlled at perimeter and building ingress points
• Professional security staff, video surveillance, and intrusion detection systems
• Access restricted to authorized personnel only
• All access logged and monitored
• Secured server racks and cabinets with locked enclosures

15. Business Continuity and Disaster Recovery

15.1 High Availability

• Application containers distributed across multiple availability zones
• Database replication and clustering across availability zones
• Automatic container recovery for unexpected exits
• Memory management with graceful container restarts

15.2 Backup and Recovery

• Daily incremental or differential backups
• Weekly full backups
• All backups encrypted
• Backups stored in physically secure remote locations
• Cross-region backups for additional redundancy
• Regular backup testing to verify media reliability and data integrity

15.3 Disaster Recovery

• Current, retrievable copy of information available before movement of servers
• Backup information tested following each backup and at least annually
• Disaster recovery procedures documented and tested

16. Compliance and Regulatory Requirements

16.1 HIPAA Compliance

SaRA Health is required to maintain HIPAA compliance as a healthcare technology company that processes Protected Health Information (PHI). We maintain:

• Business Associate Agreements (BAAs) with all vendors processing PHI
• HIPAA-compliant practices throughout application development, data handling, and operations
• Administrative, physical, and technical safeguards as required by HIPAA

16.2 HITECH Act Compliance

We comply with HITECH Act requirements, including breach notification procedures and security standards for electronic health information.

16.3 Infrastructure Certifications

Our infrastructure provider, Aptible, maintains:

• SOC 2 Type 2 certification
• HITRUST CSF certification
• Regular independent audits

17. Security Training and Awareness

17.1 Employee Training

• Security training provided during onboarding
• Training on an as-needed basis when security policies are updated or security concerns arise
• Ongoing security guidance through engineering leadership
• Documentation of security best practices maintained
• Formal annual security training program in development

17.2 Security Awareness

• Security best practices documented and communicated
• Regular updates on security policies and procedures
• Awareness of security threats and mitigation strategies

18. Data Retention and Disposal

18.1 Data Retention

• Data retained according to operational needs and compliance requirements
• Retention policies aligned with HIPAA requirements
• Audit logs maintained for compliance purposes

18.2 Data Disposal

• Secure data disposal procedures for end-of-life data
• Encryption ensures data remains protected throughout lifecycle
• Disposal procedures comply with HIPAA requirements

19. Security Monitoring and Continuous Improvement

19.1 Continuous Monitoring

• 24/7 security monitoring by Aptible's security team
• Application-level monitoring through Sentry
• Regular review of security events and patterns
• Continuous improvement of security controls

19.2 Security Assessments

• Infrastructure provider (Aptible) undergoes regular third-party penetration testing
• Quarterly vulnerability assessments
• Application-level penetration testing under evaluation
• Regular security reviews and updates to this policy

20. Policy Review and Updates

This Information Security Policy is reviewed and updated as needed to reflect changes in technology, business practices, regulatory requirements, and security threats. Updates are communicated to all relevant personnel.

---

Document Control:

• Policy Owner: Chief Technology Officer
• Review Frequency: Annually or as needed
• Approval Authority: Chief Technology Officer
• Distribution: All employees, contractors, and relevant third parties

--

HOW TO CONTACT US

If you have any questions or comments about this Privacy Policy, our privacy practices or if you would like to exercise your rights and choices, please contact us at [email protected] or by writing to us at:

4050 Pennsylvania Ave Ste 115 #78 Kansas City, MO 64111-3041

Questions about security: help@sarahealth.com