Loading…
Loading…
Behavioral health data is the most sensitive category in healthcare. Navix is engineered for HIPAA, 42 CFR Part 2, SOC 2, ONC Health IT (Drummond), and TCPA from the foundation up — not retrofitted.
Full HIPAA Privacy + Security Rule compliance. BAA included with every paid plan.
Type II audited. Security, availability, confidentiality, processing integrity controls.
ONC Health IT certified through Drummond Group, an ONC-Authorized Certification Body (ONC-ACB). Validates interoperability, security, and clinical-functionality standards.
Substance use disorder records protected with the heightened consent + re-disclosure controls Part 2 requires.
Full opt-in flow with mobile verification. STOP/HELP keyword support. No PHI over SMS.
Security controls
All data encrypted in transit (TLS 1.3) and at rest (AES-256). Keys managed via AWS KMS with regular rotation.
Role-based access controls. SSO via SAML 2.0 / OIDC for enterprise. Mandatory two-factor authentication. Session timeouts and IP allowlisting available.
Append-only logs of every PHI access — who viewed which record, when, from what IP, and what actions they took. Retained per HIPAA Security Rule requirements.
Hosted on AWS in HIPAA-eligible regions. VPC isolation, private subnets, security groups, and least-privilege IAM. Continuous vulnerability scanning.
Documented incident response plan. 24/7 monitoring with PagerDuty escalation. Breach notification procedures align with HIPAA's 60-day rule.
Daily encrypted backups with point-in-time recovery. Multi-AZ failover. Tested disaster recovery plan with documented RPO/RTO.
Mandatory HIPAA and security training for all employees. Background checks. Confidentiality agreements. Least-privilege access for engineering.
Subcontractor BAAs in place with all PHI-handling third parties. Annual vendor reviews. Vendor risk register maintained.
AI/ML safeguards
AI in healthcare requires a higher bar than AI in consumer software. Here's how Navix handles training data, customer isolation, and model governance.
42 CFR Part 2
42 CFR Part 2 places stricter controls than HIPAA on disclosure of substance use disorder records. Written patient consent is generally required for any disclosure; recipients are prohibited from re-disclosure. The penalties for violation are severe.
Navix is engineered around these requirements. Part 2 records carry an enhanced consent flag throughout the system. Every disclosure is logged. Re-disclosure warnings are surfaced where they matter. Our de-identification methods meet the Part 2 standard.
We provide our SOC 2 Type II report, BAA, security questionnaire responses, and penetration test summaries to qualified prospects under NDA.