Security & Compliance
Every process we perform is governed by the highest global standards for data privacy, patient confidentiality, and information security.
Our Commitment
At Cynefine, data security is not a feature — it is the foundation of everything we do. Every team member is trained, every system is hardened, and every client relationship begins with a signed Business Associate Agreement (BAA).
Compliance Frameworks
We adhere to the most rigorous standards in healthcare data security.
HIPAA
Health Insurance Portability and Accountability Act. US federal law governing the privacy and security of protected health information (PHI). All Cynefine processes are fully HIPAA-compliant.
HITECH Act
Health Information Technology for Economic and Clinical Health Act. Strengthens HIPAA privacy and security enforcement specifically for electronic health records and digital PHI.
GDPR
General Data Protection Regulation. EU framework ensuring the highest standard of data privacy for all European clients and their patients.
SOC 2 Type II
Independent audit standard verifying our security, availability, processing integrity, confidentiality, and privacy controls.
ISO 27001
International standard for Information Security Management Systems — the global benchmark for data protection.
HL7 / FHIR
Health Level 7 and Fast Healthcare Interoperability Resources. Standards governing structured health data exchange and system interoperability.
What We Do
End-to-End AES-256 Encryption
All data is encrypted in transit and at rest using military-grade AES-256 encryption standards.
Role-Based Access Control
Minimum necessary access principle enforced across all systems and personnel.
Full Audit Trail
Every record accessed or modified is logged with a complete, tamper-proof audit trail.
BAA First
Business Associate Agreement signed with every client before any PHI is handled.
Annual Security Audits
Third-party penetration testing and security audits conducted annually.
Data Handling Policy
All patient data is processed exclusively on HIPAA-compliant infrastructure. We never sell, share, or repurpose patient data for any reason beyond the contracted service. All Cynefine team members undergo mandatory annual HIPAA training and sign individual confidentiality agreements before handling any protected information.
Have compliance questions?
Our security team is ready to discuss your specific compliance requirements.
Contact Us