HIPAA Compliance

We operate as a Business Associate for our healthcare practice clients. We execute a comprehensive Business Associate Agreement (BAA) with every covered entity we serve before any PHI is processed by our systems. We also ensure that all of our sub-processors are bound by equivalent BAA requirements.

We employ robust cryptographic standards to protect data at every stage:

• In transit. All data transmitted between your practice, EHR systems, and our servers is encrypted using TLS 1.2 or higher.
• At rest. All databases, storage volumes, and backups containing PHI are encrypted at rest using AES-256 encryption.

Access to systems containing PHI is strictly controlled. We enforce:

• Role-based access control (RBAC) ensuring employees only have access necessary for their specific job functions.
• Mandatory Multi-Factor Authentication (MFA) for all internal systems and client accounts.
• Automatic session timeouts for inactive sessions.

Every action taken within the Wybit platform that interacts with PHI is logged. Our comprehensive audit trails record who accessed what data, when, and from where. These logs are protected against tampering and retained in accordance with HIPAA requirements.

Our agents are designed to pull only the data necessary to perform their specific functions. Whenever possible, our processing pipelines interact with data within your existing secure infrastructure, minimizing the footprint of data stored externally.

Every Wybit employee undergoes comprehensive HIPAA and security awareness training during onboarding, with mandatory annual recertification. Our engineering team follows secure coding practices specifically tailored for healthcare applications.