Book a Demo
Agents Connectors Learning Platform Pricing Billing Agencies Roadmap About Login Book a Demo

HIPAA

How ClaimVise protects patient data.

ClaimVise is built for healthcare. This page lists what is in place today and, separately, what is planned. We would rather show you both than make a claim we cannot back up.

Business Associate Agreement.

ClaimVise signs a Business Associate Agreement (BAA) with every customer that handles Protected Health Information (PHI) on our platform. The BAA sets out our duties under the HIPAA Privacy Rule (45 CFR Part 164 Subpart E), Security Rule (Subpart C) and Breach Notification Rule (Subpart D).

All AI processing runs on AWS Bedrock under an executed AWS Business Associate Addendum, signed May 22, 2026 between Innodel Technologies Pvt Ltd and Amazon Web Services. The platform will not start unless an AI provider has been chosen on purpose. The direct provider path, which has no BAA, is not used for PHI.

Technical safeguards in place today.

Encryption in transit

Every connection to ClaimVise uses HTTPS, with certificates from Let's Encrypt. Plain HTTP is redirected to HTTPS.

Credential protection

The logins an agency stores for a practice's EMR, billing system and eligibility portal are held in an encrypted vault. Only the agency's administrators can manage them, and the platform's own superadmin cannot read them. Secrets are never written to the audit log, and one-time codes typed for the eligibility portal are stored encrypted, used once and never returned.

Tamper-evident audit trail

We log every PHI access, agent decision, supervisor override, export and posting request. Each entry carries a SHA-256 hash, a digital fingerprint of the event. Whenever an audit record is read, the fingerprint is checked again. If it does not match, we treat that as a sign of tampering. Audit entries hold identifiers, counts and codes, never clinical content.

This supports HIPAA §164.312(b) (Audit controls) and §164.312(c)(1) (Integrity).

Access control and tenant isolation

Users sign in with a password, and sessions expire on their own. Login attempts are rate-limited to slow down password guessing. Access depends on role: agency admin, supervisor, coder or AR caller. Data is kept apart by agency and by practice. A user can reach only the practices they are assigned to, and no agency can see another agency's data. A superadmin can pause an organization or a practice.

This supports §164.312(a) (Access control) and §164.312(d) (Person or entity authentication).

File upload validation

We check every uploaded file by what is inside it, not by its file extension. A file that says it is a PDF but is not one is rejected before anything is processed.

Minimum PHI in logs

Application and connector logs carry identifiers, counts and codes, not patient names or clinical text. Connector screenshots and eligibility pages that we must keep for support sit in folders with restricted access.

Planned, not in place yet.

These items are on our roadmap. We list them here so nothing on this page reads as already done.

  • AWS-hosted infrastructure. The application and its database currently run on a hosting provider's servers in France (European Union), and AI processing runs on AWS in the United States. Moving the full platform to AWS HIPAA-eligible infrastructure is in progress, with a target of 30 November 2026. We will tell customers when it is done.
  • Encryption at rest for database and file storage, as part of that move.
  • SOC 2 Type 2 attestation: in scope for Q1 2027. HITRUST certification: in scope for Q3 2027.

Policies.

Innodel Technologies keeps written policies on staff training for PHI, giving and removing access, incident response and breach notification. Active customers can ask for a copy of our compliance documentation package.

Our staff.

Everyone at Innodel Technologies who could see PHI signs a personal confidentiality agreement and completes HIPAA awareness training before getting access. We follow the minimum-necessary rule. Developers do not look at production PHI for support unless they are approved for a specific incident, and that access is logged.

Breach notification.

If a security incident may have exposed PHI, ClaimVise notifies affected customers without unreasonable delay and no later than 60 days after discovery, as §164.410 (Notification by a business associate) requires. Customers remain responsible for notifying affected patients under §164.404.

Contact.

For compliance questions, to sign a BAA, or to ask for our compliance documentation package, contact chirag@innodel.com with "HIPAA" in the subject line.