HIPAA Security & Privacy

Health Insurance Portability and Accountability Act of 1996

Shteg.ai is fully compliant with all three HIPAA Rules. This document provides a comprehensive overview of our administrative, physical, and technical safeguards, our Privacy Rule implementation, and our Breach Notification procedures.

Privacy Rule Compliant Security Rule Compliant Breach Notification Rule Compliant Last Audit: March 2026

1. Privacy Rule Safeguards 2. Administrative Safeguards 3. Physical Safeguards 4. Technical Safeguards 5. Breach Notification Procedures 6. Security Contact

1. Privacy Rule Safeguards

The HIPAA Privacy Rule (45 CFR Part 160 and Part 164, Subparts A and E) establishes national standards for the protection of individually identifiable health information (PHI). Shteg.ai implements the following safeguards:

Notice of Privacy Practices (NPP)

Every patient receives a clear, plain-language NPP upon registration explaining how their PHI may be used, disclosed, and their rights under HIPAA. Electronic NPP is available via the Patient Portal with digital acknowledgment tracking.

Minimum Necessary Standard

All system access is scoped to the minimum data necessary to perform a given function. Clinical staff see only their patients. Billing personnel see only financial fields. Administrators have tiered access per their role assignment.

Patient Rights Implementation

Patients may request access to their records, amendments, restriction of uses, accounting of disclosures, and confidential communications through the portal or in writing. Responses are processed within 30 days per §164.524.

De-identification Standards

Research and analytics data is de-identified using both the Expert Determination method (§164.514(b)(1)) and the Safe Harbor method (removal of all 18 HIPAA identifiers). The Auditor Portal uses a PII-masked data layer.

Authorization & Consent Management

Shteg.ai tracks granular patient authorizations for specific use/disclosure beyond treatment, payment, and healthcare operations. Revocations are processed immediately with retroactive data access termination.

2. Administrative Safeguards

Administrative safeguards (§164.308) are the policies and procedures designed to clearly show how the entity will comply with HIPAA.

Security Management Process (§164.308(a)(1))

Annual risk analysis per NIST SP 800-30
Quarterly vulnerability scanning (Qualys/Nessus)
Penetration testing by independent third party (annual)
Risk remediation tracking with CISO sign-off

Workforce Security (§164.308(a)(3))

Background checks for all personnel with PHI access
Termination procedure with immediate credential revocation
Quarterly access reviews and recertification
Documented sanctions policy for violations

Information Access Management (§164.308(a)(4))

14-level RBAC (Role-Based Access Control) model
Privilege escalation requires dual-approval workflow
Emergency access ("break-the-glass") with mandatory audit review
Automatic access expiration for temporary personnel

Security Awareness & Training (§164.308(a)(5))

HIPAA training upon hire (mandatory, scored)
Annual refresher training with certification
Monthly simulated phishing campaigns
Real-time security alerts for anomalous login behavior

Contingency Plan (§164.308(a)(7))

Documented data backup plan with RPO = 1 hour
Disaster recovery plan with RTO = 4 hours
Annual DR testing with full failover simulation
Emergency mode operation procedures documented

3. Physical Safeguards

Physical safeguards (§164.310) are the physical measures, policies, and procedures to protect electronic information systems and related buildings and equipment from natural and environmental hazards and unauthorized intrusion.

Facility Access Controls (§164.310(a))

Google Cloud data centers: SOC 2 / ISO 27001 certified
Biometric + badge access at all physical locations
Visitor logs with escort requirements
24/7 video surveillance with 90-day retention

Workstation Security (§164.310(b)-(c))

Full-disk encryption (FDE) on all company devices
Auto-lock screen after 5 minutes of inactivity
Endpoint Detection & Response (EDR) via CrowdStrike
Remote wipe capability for lost/stolen devices

Device & Media Controls (§164.310(d))

Hardware inventory with asset tracking
Certified destruction of storage media (NIST SP 800-88)
PHI prohibited on removable media (USB, external drives)
Secure paper document shredding (cross-cut, NAID certified)

4. Technical Safeguards

Technical safeguards (§164.312) are the technology and the policy and procedures for its use that protect ePHI and control access to it.

Access Control (§164.312(a))

Unique user IDs for every individual (no shared accounts)
MFA enforced for all users (TOTP + biometric options)
Session tokens rotate every 15 minutes
Automatic session timeout after 20 minutes idle
IP-based geo-fencing for administrative access

Audit Controls (§164.312(b))

Immutable audit logs for every PHI access event
Log aggregation via Google Cloud Logging + BigQuery
Real-time alerting on suspicious access patterns
Audit log retention: 7 years (exceeds 6-year HIPAA minimum)
Monthly audit log review by compliance team

Integrity Controls (§164.312(c))

Checksums (SHA-256) on all PHI data at rest
Database transaction integrity with ACID compliance
Application-level input validation and sanitization
Version-controlled schema migrations with rollback

Transmission Security (§164.312(e))

TLS 1.3 for all data in transit (no TLS 1.0/1.1)
mTLS (mutual TLS) for HIE/Connie state exchange
HSTS enforcement with preloading
Certificate transparency monitoring

Encryption (§164.312(a)(2)(iv))

AES-256-GCM encryption at rest (database + storage)
Column-level encryption for SSN, DOB, financial fields
Envelope encryption with Google Cloud KMS
Customer-managed encryption keys (CMEK) available for enterprise

5. Breach Notification Procedures

In accordance with the Breach Notification Rule (§164.400–414) and the HITECH Act, Shteg.ai maintains a documented incident response plan with the following procedure:

Detection & Containment

0–1 hours

Automated threat detection triggers incident response. Security team isolates affected systems, preserves forensic evidence, and activates the Incident Commander.

Assessment & Classification

1–24 hours

Four-factor risk assessment per §164.402: (1) nature/extent of PHI, (2) unauthorized person, (3) whether PHI was acquired/viewed, (4) extent risk is mitigated.

Notification Preparation

24–48 hours

Draft notifications for affected individuals, HHS, and media (if ≥500 records). Legal review of notification content and methods.

Individual Notification

Within 60 days

Written notification by first-class mail (or email if authorized) to each affected individual describing what happened, type of PHI, recommended protective steps, and remediation actions.

HHS Notification

Within 60 days if ≥500

Electronic submission to HHS Secretary via breach portal. Breaches affecting <500 individuals reported by year-end via annual log.

Media Notification

Within 60 days if ≥500

Prominent media outlets in affected state/jurisdiction notified for breaches affecting ≥500 residents of that state.

Post-Incident Review

30 days post

Root-cause analysis, policy/procedure updates, additional training, and improvements to prevent recurrence. Board-level briefing for material incidents.

HIPAA Security Officer Contact

Shteg.ai designates a HIPAA Security Officer and Privacy Officer responsible for the development, implementation, and maintenance of all policies and procedures required by the HIPAA Security Rule and Privacy Rule.

Security Inquiries

Privacy Inquiries

BAA Requests

Breach Reporting

HIPAA Security Officer Contact

HIPAA Security & Privacy

Table of Contents

1. Privacy Rule Safeguards

Notice of Privacy Practices (NPP)

Minimum Necessary Standard

Patient Rights Implementation

De-identification Standards

Authorization & Consent Management

2. Administrative Safeguards

Security Management Process (§164.308(a)(1))

Workforce Security (§164.308(a)(3))

Information Access Management (§164.308(a)(4))

Security Awareness & Training (§164.308(a)(5))

Contingency Plan (§164.308(a)(7))

3. Physical Safeguards

Facility Access Controls (§164.310(a))

Workstation Security (§164.310(b)-(c))

Device & Media Controls (§164.310(d))

4. Technical Safeguards

Access Control (§164.312(a))

Audit Controls (§164.312(b))

Integrity Controls (§164.312(c))

Transmission Security (§164.312(e))

Encryption (§164.312(a)(2)(iv))

5. Breach Notification Procedures

Detection & Containment

Assessment & Classification

Notification Preparation

Individual Notification

HHS Notification

Media Notification

Post-Incident Review

HIPAA Security Officer Contact

HIPAA Security & Privacy

Table of Contents

1. Privacy Rule Safeguards

Notice of Privacy Practices (NPP)

Minimum Necessary Standard

Patient Rights Implementation

De-identification Standards

Authorization & Consent Management

2. Administrative Safeguards

Security Management Process (§164.308(a)(1))

Workforce Security (§164.308(a)(3))

Information Access Management (§164.308(a)(4))

Security Awareness & Training (§164.308(a)(5))

Contingency Plan (§164.308(a)(7))

3. Physical Safeguards

Facility Access Controls (§164.310(a))

Workstation Security (§164.310(b)-(c))

Device & Media Controls (§164.310(d))

4. Technical Safeguards

Access Control (§164.312(a))

Audit Controls (§164.312(b))

Integrity Controls (§164.312(c))

Transmission Security (§164.312(e))

Encryption (§164.312(a)(2)(iv))

5. Breach Notification Procedures

Detection & Containment

Assessment & Classification

Notification Preparation

Individual Notification

HHS Notification

Media Notification

Post-Incident Review

HIPAA Security Officer Contact