Procedo Health: HIPAA Compliance

Patient data is protected at every step through Procedo: while it moves between systems, while it is stored, and in a complete record of who accessed it and when. That protection meets the technical safeguards HIPAA requires and the standards hospital security teams expect.

Technical safeguards

Controls applied at the infrastructure and application level to protect PHI.

AES-256 encryption at rest

All stored data (database records, blobs, secrets) is encrypted using AES-256 via Azure-managed keys and Azure Key Vault.

TLS 1.2+ in transit

All data in transit between clients, services, and the EMR FHIR API is encrypted with TLS 1.2 or higher. HTTP is not permitted.

Azure Key Vault secrets management

API keys, connection strings, and credentials are stored exclusively in Azure Key Vault. No secrets in application config or code.

Role-based access control (RBAC)

Access to patient data and administrative functions is gated by role. Least-privilege is enforced at both the application and Azure resource level.

Multi-tenant data isolation

Each hospital tenant's data is isolated at the database and application layer. Cross-tenant data access is architecturally prevented.

PHI access audit logging

Every access to patient data is logged with a user identifier, timestamp, and action. Logs are retained and tamper-evident.

Data retention & recovery

Long-term audit retention and point-in-time recovery controls aligned with HIPAA's 6-year documentation requirement.

6-year SQL audit log retention

Database audit logs are retained for 2,190 days (6 years) in blob storage, meeting HIPAA's documentation retention requirement.

90-day blob soft delete

Deleted blob data is retained in a soft-deleted state for 90 days, enabling recovery from accidental deletion without data loss.

Built on trusted infrastructure

Procedo is built on Microsoft Azure and Google Cloud, the same enterprise platforms used across regulated healthcare. Any patient data they process on Procedo's behalf is covered under HIPAA-compliant terms.

Microsoft Azure

Primary cloud infrastructure: App Service, Azure SQL, Azure Key Vault, Blob Storage, Log Analytics

Google Cloud

AI model inference via Vertex AI (Gemini), used for clinical narrative generation

Human-in-the-loop by design

A clinical governance principle enforced at the architecture level, not as a UI option.

No AI output is ever applied to a patient record without explicit clinician review

Procedo operates as an orchestration layer above the EMR. It surfaces AI-generated clinical intelligence for review, but writing anything to a patient record requires a licensed clinician to explicitly approve it. This is not a configurable setting. It is enforced architecturally. Every approval action is recorded in the audit trail with a clinician identifier and timestamp.