HIPAA Compliance
We understand how sensitive the records you keep are. Benol Care is built around the HIPAA Security Rule’s administrative, physical and technical safeguards, and we sign a Business Associate Agreement with every organization before any protected health information goes live.
About this statement. This HIPAA Compliance Statement tells our customers — who are “covered entities” under HIPAA — that we understand our obligations as a business associate and the safeguards we maintain. It is a summary for your due diligence; it does not replace the Business Associate Agreement, which is the governing legal document between us.
How the platform protects PHI
Access control
Unique user identification, role-based permissions, and access scoped down to the individual resident — so staff reach only the records they’re authorized to see.
Transmission security
All data in transit is encrypted with TLS 1.2+ over enforced HTTPS, with HSTS, protecting PHI as it moves between your team and our servers.
Encryption
Data at rest is protected by full-volume encryption on HIPAA-grade hosting, and particularly sensitive identifiers are additionally encrypted at the application layer with AES-256.
Audit controls
Sensitive actions are recorded to an audit log, and medication and note entries are append-only — corrections supersede the original rather than overwriting it.
Automatic logoff
Idle sessions end automatically, with the timeout set per organization, to protect shared workstations in a care setting.
Integrity & authentication
Passwords are stored only as salted hashes, sign-ins are rate-limited and logged with device and IP, and finalized clinical records are tamper-evident.
Policies and hosting behind the software
Business Associate Agreement
We sign a BAA with every organization before any live PHI, establishing how we may use and protect your data and our breach-notification duties under 45 CFR 164.
Least-privilege & accountability
Access is granted on a need-to-know basis and can be restricted or revoked at any time. We maintain a designated security contact and confidentiality obligations for anyone who can access systems.
Breach notification
If a breach affecting your PHI were to occur, we will notify you without unreasonable delay and within the timeframe your BAA and 45 CFR 164.410 require.
Hosting
PHI is hosted on HIPAA-grade infrastructure with encrypted storage, automated encrypted backups, restricted access controls, and a signed Business Associate Agreement with our hosting provider.
Compliant from day one
We start with a demo and a signed BAA — never a self-serve free-for-all with real resident data.