VitaAI is built for healthcare — where data integrity, patient privacy, and regulatory compliance aren't optional. Review our security controls, our real-time compliance roadmap, and our documentation library.
Built on Microsoft Azure's certified infrastructure
These certifications belong to Microsoft Azure's underlying infrastructure — details at microsoft.com/trust-center. For VitaAI's own compliance program status, including our SOC 2 Type II timeline, see the Compliance Roadmap.
Vendor security reviews shouldn't require reading between the lines of marketing copy. Our Compliance Roadmap shows exactly which controls are implemented today, which are in progress, and our target dates — control by control, updated as our program matures.
VitaAI implements defense-in-depth across infrastructure, application, and data layers — ensuring PHI is protected regardless of where it resides or transits.
All stored data encrypted with AES-256. Azure Storage Service Encryption applied by default. Customer-managed key (CMK) support via Azure Key Vault available for enterprise accounts.
All data in transit protected with TLS 1.2 minimum (1.3 where supported). Strict HTTPS enforcement with HSTS (1-year max-age, preload). Forward secrecy via ECDHE cipher suites.
Comprehensive, tamper-evident, hash-chained audit logs for all PHI access events. Logs retained for six years in immutable WORM storage, per HIPAA §164.312(b). Exportable to SIEM systems (Sentinel, Splunk).
Least-privilege RBAC with Azure Active Directory integration. Clinician, admin, and read-only roles with granular resource scoping. Just-in-time privileged access for administrative operations.
Sensitive PHI fields (SSN, DOB, diagnosis codes) encrypted individually at the application layer — separate from disk-level encryption — ensuring data is protected even within the database engine.
Multi-factor authentication enforced for all user accounts. SAML 2.0 / OIDC single sign-on for seamless, secure integration with your organization's existing identity provider (Okta, Azure AD, Ping).
Database access restricted to the application's connection string only — no direct SQL admin access to production. Azure's platform-level DDoS protection covers all endpoints. HTTPS redirect enforced everywhere.
Continuous dependency scanning with automated CVE alerting (NuGet/npm audit gates in CI/CD). Independent third-party penetration testing scheduled for Q3 2026, with an annual cadence thereafter — see our Compliance Roadmap for current status.
Geo-redundant data replication across Azure paired regions. Recovery Point Objective (RPO) of 5 minutes; Recovery Time Objective (RTO) of 1 hour for the database tier. Redeploy drills run quarterly — full detail on our Disaster Recovery page.
VitaAI operates as a Business Associate under HIPAA when processing Protected Health Information on behalf of covered entities. We execute a Business Associate Agreement (BAA) with every customer that handles PHI.
Our security posture is grounded in a formal HIPAA risk assessment (HHS SRA Tool, aligned with the NIST Cybersecurity Framework), reviewed on an annual cycle. See the full control-by-control status on our Compliance Roadmap.
VitaAI integrates with Epic and other major EHR platforms via industry-standard HL7 FHIR R4 APIs — no custom interfaces, no shadow copies of data.
VitaAI connects to Epic and other FHIR R4-compliant EHR systems via the HL7 FHIR R4 API, enabling real-time, bidirectional clinical data exchange without bulk data exports or custom ETL pipelines. Patient data is queried on-demand, minimizing PHI at rest in VitaAI's systems. OAuth 2.0 SMART on FHIR authorization ensures patient-level consent is enforced at the EHR layer.
Download our security documentation to accelerate your organization's vendor assessment and procurement process. All compliance documents are available in both PDF and Word formats.
27 documents available
Detailed mapping of VitaAI's administrative, physical, and technical safeguards to the HIPAA Security Rule.
Last updated: August 14, 2026
Executive summary of VitaAI's security program, infrastructure architecture, and compliance posture for procurement teams.
Last updated: August 14, 2026
Standard BAA template for covered entities. Pre-signed by VitaAI. Send to legal for review or request a countersigned copy.
Last updated: June 1, 2026
Vendor questionnaire responses aligned to NIST CSF, CIS Controls v8, and common hospital procurement frameworks.
Last updated: August 14, 2026
Reference architecture diagrams showing network topology, data flows, integration points, and security boundaries.
Last updated: June 1, 2026
The signed Business Associate Agreement between Microsoft and Azure customers confirming HIPAA-compliant infrastructure obligations.
Last updated: May 23, 2025 (published by Microsoft)
Formal CC9 risk register mapping 12 identified risks to SOC 2 Trust Services Criteria with current controls, residual risk ratings, and mitigation owners.
Last updated: August 14, 2026
Describes how VitaAI collects, uses, discloses, and protects personal information and PHI. Covers patient rights under HIPAA.
Last updated: June 1, 2026
Governs authorized use of the VitaAI platform, user responsibilities, IP rights, liability limitations, and prohibited activities.
Last updated: June 1, 2026
Standard enterprise healthcare SaaS agreement governing subscriptions, data protection obligations, SLAs, and IP rights.
Last updated: June 1, 2026
Company values, workplace standards, HIPAA obligations, anti-harassment policy, remote work guidelines, and professional conduct standards.
Last updated: June 1, 2026
Workforce confidentiality agreement signed by all employees and contractors. Covers PHI handling, trade secrets, and post-separation obligations.
Last updated: June 1, 2026
Formal role definitions, responsibilities, and qualifications for all key positions: CEO, Lead Engineer, Security Officer, DevOps, and Customer Success.
Last updated: June 1, 2026
Progressive discipline policy for policy violations and HIPAA infractions. Defines sanctions from verbal warning through immediate termination.
Last updated: June 1, 2026
Formal designation of the HIPAA Security Officer and Privacy Officer as required by 45 CFR §164.308(a)(2) and §164.530(a).
Last updated: June 1, 2026
Defines authorized use of VitaAI systems, PHI handling requirements, password standards, device controls, and prohibited activities for all workforce members.
Last updated: June 1, 2026
Cryptographic standards for data at rest (AES-256-GCM), in transit (TLS 1.3), key management via Azure Key Vault, and cipher suite configuration.
Last updated: June 1, 2026
Process for requesting, reviewing, approving, and deploying changes to production. Covers standard, normal, and emergency change categories.
Last updated: June 1, 2026
Security activities at each SDLC phase: threat modeling, secure coding standards, OWASP code review checklist, SAST, DAST, and annual penetration testing.
Last updated: June 1, 2026
HIPAA-aligned retention schedule for PHI (6 years), audit logs, contracts, and financial records. Covers legal holds and automated enforcement.
Last updated: June 1, 2026
Secure destruction procedures for PHI on electronic media, cloud storage, and physical documents. Covers certificate of destruction requirements.
Last updated: June 1, 2026
Enterprise risk framework aligned to NIST RMF. Covers risk identification, scoring (Likelihood × Impact), treatment selection, and annual review cycle.
Last updated: June 1, 2026
Active register of 12 identified risks — credential theft, ransomware, injection, insider threat, vendor breach — with scores, controls, and remediation status.
Last updated: June 1, 2026
Annual fraud risk review covering financial operations, healthcare billing, and technology domains with controls evaluation and anti-fraud program.
Last updated: June 1, 2026
Tier-based evaluation of critical vendors (Microsoft Azure, DoseSpot, Availity, Resend). Covers BAA status, certifications, and onboarding requirements.
Last updated: June 1, 2026
Audit logging requirements for PHI access, authentication, API calls, and infrastructure events. Covers 6-year immutable retention and real-time alerting rules.
Last updated: June 1, 2026
Azure App Service security hardening: TLS configuration, cipher suites (Qualys A+), HSTS, security response headers, network isolation, and patch management.
Last updated: June 1, 2026
Documents under NDA or not listed above? Contact steven@altnetix.com
Our security team can provide a signed BAA, answer procurement questions, or schedule a technical deep-dive for your IT and compliance teams.