Security and HIPAA

The genusConnect care platform runs on Amazon Web Services (AWS) under our Business Associate Agreement with AWS. Our infrastructure brings together managed identity, encrypted databases and storage, and application services that support care programs.

AWS is responsible for the security of its cloud infrastructure. genusConnect and its partners remain responsible for the way the application is configured and used, including access, data handling, and operating practices.

• Encryption and access controls help protect sensitive information in transit and at rest.
• Database backup and recovery capabilities support continuity planning.
• Our deployment process requires HIPAA-eligible AWS services and applicable BAA coverage for workloads that handle protected health information.

genusAI uses frontier models for de-identified information. Sensitive information is handled by private internal models running on genusConnect’s own hardware and data systems.

Our onboarding process establishes the program’s purpose, the people using it, and the information it needs. Branded previews use sample people and notes unless the relevant program has authorized live care data under the applicable agreements and safeguards.

genusConnect supports managed AWS deployment, with a separate workload account available as a scoped deployment option. Environment ownership, region, permissions, integrations, and support responsibilities are agreed for the project.

• We agree with the partner who operates the environment and who administers access.
• Onboarding covers data retention, backups, recovery expectations, and incident contacts for the deployment.
• Our deployment process requires validation of the agreed workflows and connections before introducing live protected health information.

HL7 develops standards for exchanging health information. FHIR, or Fast Healthcare Interoperability Resources, is one of those standards and supports exchanging defined healthcare data through interfaces such as APIs.

HL7 v2 and FHIR connections are scoped with your IT team and system vendors. The available interfaces, information to be exchanged, permissions, and care workflow determine the approach and implementation effort.

• We agree the sending and receiving systems, data fields, and patient-matching approach with the partner and system vendors.
• The integration scope sets consent and access rules, error handling, and responsibility for supporting the connection.
• Each agreed interface requires testing before use in a live program. Connection availability is confirmed for each project.

Single sign-on (SSO) can let staff use their organization’s identity to access a connected service. genusConnect uses Amazon Cognito for current authentication; partner SSO is scoped implementation work.

Together, we evaluate SAML or OpenID Connect (OIDC), the organization’s identity provider, and the permissions staff need. A successful sign-in still needs the right application role and organization access.

• We agree identity-provider configuration, role mapping, and multifactor authentication requirements with the partner’s identity team.
• The implementation scope covers account creation, staff changes, access removal, and session behavior.
• Connection checks and staff-journey testing are required before SSO is enabled for the program.

• Protected health information is encrypted in transit and at rest. Care-platform safeguards include managed identity, scoped access, and backups. We review the applicable controls and configuration with each partner during deployment onboarding.
• Program onboarding sets staff permissions, authentication requirements, access-removal responsibilities, and permitted disclosures. Partners are responsible for keeping their authorized-user access current.
• We establish recovery expectations, incident contacts, retention requirements, and staff responsibilities with the partner. Service levels are governed by the applicable agreement.
• Public website inquiries use Cloudflare D1 and Resend. Google Forms, Calendly, and care-wall previews are separate integrations described in the Privacy Policy; the care platform’s AWS agreement does not automatically cover them.

A business associate may handle protected health information only as permitted by its agreement and applicable law. A general website privacy notice does not replace a healthcare provider’s Notice of Privacy Practices or a program-specific notice.

HIPAA’s minimum-necessary standard applies where required, with exceptions including certain disclosures for treatment. Access and disclosure still need an appropriate legal basis.

Requests for access, amendment, restrictions, confidential communications, or an accounting of disclosures depend on the records and the applicable rules. Contact the provider responsible for your care records; our support team can help identify the relevant program.

HIPAA does not establish a general medical-record retention period. Other laws, agreements, and record types affect retention; required HIPAA compliance documentation has its own retention requirements.

Additional rules can apply to substance-use-disorder records. The relevant provider or program supplies its required notices.

Tell support which service is involved and how we can contact you. Keep medical records, passwords, and other sensitive details out of the first message. For a care-program issue, also use the partner’s incident or support channel. This website and email are not emergency services.

Our response responsibilities include assessing the incident, addressing its effects, documenting the response, and coordinating required reporting with the affected partner. The applicable agreement assigns contacts and reporting responsibilities.

For a breach of unsecured protected health information in a service where we act as a business associate, we notify the covered entity without unreasonable delay and no later than 60 days after discovery, or sooner when the applicable agreement requires it.

We carry out notification duties assigned to us by law or agreement. Individual, regulator, and media notices have different requirements depending on the responsible party and circumstances. Other privacy and breach laws can also apply outside HIPAA.