HIPAA readiness

A living compliance record for the safeguards we are building into HiCareGiver.

This page documents the technical, administrative, and operational work being implemented as HiCareGiver becomes HIPAA-ready for agencies handling sensitive caregiver and patient-related information.

Review implemented controls Schedule a demo

Implemented controls

Documented safeguards already added to the platform.

These controls help explain how HiCareGiver protects access, records activity, and reduces operational risks around sensitive information.

Implemented Access security

Secure authentication and protected passwords

User authentication is handled through secure login controls, with passwords protected using strong hashing such as Argon2 or bcrypt.

Risk reduced

Reduces the chance that stolen credentials or exposed password data can be used to access sensitive account areas.

Authentication is required before users can access protected areas of the platform.
Passwords are stored with strong one-way hashing rather than plain text.
Password protection is part of the access security controls documented for HIPAA readiness.

Implemented Access security

Active session and device management

Users can review active sessions tied to their account, identify connected devices, and remotely end sessions they no longer recognize or use.

Risk reduced

Improves account visibility and reduces unauthorized access risk by giving users control over stale, unknown, or unattended authenticated sessions.

Users can end individual active sessions except the current one.
Users can end all other sessions while keeping the current session active.
Session last activity is updated as the user interacts with the application.
Expired sessions can no longer perform authenticated requests.
Device history is informational only and does not automatically trust or block devices.
Access to session management is controlled by permissions and users can only manage their own sessions.
Audit events are recorded for manual session termination, all-other-sessions termination, and first-time device detection.
Audit metadata includes user id, session id, device information, browser, operating system, IP address, timestamp, and event type when available.

Partially implemented Permission control

Role-based permission control with granular admin access

Administrative users can be assigned admin roles with permission codes that limit what they can view, edit, manage, approve, or configure inside protected assistant workflows.

Risk reduced

Reduces unnecessary access by helping each user work only with the staff, patient, scheduling, document, reporting, or settings areas needed for their job.

RBAC uses administrative roles assigned to users and role-level permissions to resolve access for assistant users.
The administrative permission matrix is managed from Settings and supports role-level permission toggles.
Seeded admin roles include Human Resources, Patient Coordinator, Scheduler, and Supervisor, with Admin or Administrator treated as full access.
Granular codes include staff.view, staff.edit, staff.documents.manage, staff.documents.approve, staff.onboarding.approve, staff.tasks.manage, patients.view, patients.edit, schedules.view, schedules.manage, reports.view, reports.management, settings.manage, users.manage, and restrictions.override.
Protected assistant, notes, announcements, communication, and alert flows are checked through required permission rules, and permission changes are logged as roles.permission_toggled.
Caregiver access is handled as a separate worker/caregiver portal role and staff discipline workflow, not as part of the admin permission matrix.

Shared responsibility

HIPAA compliance depends on both the platform safeguards and how each agency configures, trains, and operates its workflows. HiCareGiver documents product controls, but this page is not legal advice or a compliance certification.

FAQ

HIPAA readiness questions

Is HiCareGiver claiming to be HIPAA certified?

No. The page documents HIPAA readiness work and implemented safeguards. It avoids treating HIPAA as a one-time certification badge.

Why document controls publicly?

Public documentation helps agencies evaluate whether the platform is taking access control, auditing, and data protection seriously before a deeper review or demo.

Will this page change over time?

Yes. It is designed as a living record where new safeguards can be added as they are implemented.

Review HiCareGiver with your agency workflow in mind.

Schedule a focused demo to discuss onboarding, compliance documentation, access controls, and readiness before scheduling.

Schedule a demo