HIPAA Compliance

1. Our role

When AMAH processes Protected Health Information (PHI) on behalf of a covered entity or business associate, AMAH acts as a business associate under the Health Insurance Portability and Accountability Act (HIPAA) and its implementing regulations (the HIPAA Rules).

2. Business Associate Agreement

AMAH offers a Business Associate Agreement (BAA) to customers who store or transmit PHI through the platform. The BAA is signed before go-live and is required for any production use that involves PHI.

Our standard BAA covers the use, disclosure, and safeguarding of PHI, breach notification obligations, subcontractor flow-down, and termination obligations consistent with HIPAA.

3. Administrative safeguards

Designated Security Official with documented responsibility for the AMAH security program.

Role-based access to PHI, limited to what each person needs for their job.

Annual privacy and security training for personnel with access to PHI or PHI systems.

4. Technical safeguards

Encryption of PHI in transit (HTTPS with HSTS) and at rest (AES-256), including database and file storage.

Password authentication with PIN and session timeout controls.

Authorization enforced at API and UI layers using a 9-role RBAC model with audit-trailed permission grants.

Append-only audit logging on actions touching PHI, reviewable through a read-only Auditor role.

5. Physical safeguards

Production infrastructure runs on cloud providers with SOC 2 Type II and HITRUST attestations.

6. Breach notification

In the unlikely event of a breach involving PHI, AMAH will notify affected customers without unreasonable delay and in no case later than the timelines required by the BAA and applicable law.

7. Subcontractors

AMAH uses a small set of subcontractors (cloud hosting, email delivery, monitoring) who receive PHI only as necessary to provide their services. All such subcontractors are bound by written agreements with terms substantially similar to our BAA.