Security & Compliance
HIPAA safeguards
ArkCloud implements technical safeguards designed to support your obligations under HIPAA, and acts as your business associate. Several administrative and physical safeguards are not yet in place. Compliance is shared, and there is no HIPAA certification for a software product to hold.
Written for: Compliance officers · Privacy officers · Security reviewers
What ArkCloud does and does not claim
| Field or control | What it means |
|---|---|
| Implemented | Encryption in transit; field-level encryption at rest of designated PHI fields; role-based access control; isolation between organisations enforced in the database; MFA for administrators (and for every user where the organisation turns that on); account lockout; audit logging of sign-ins, administrative actions and PHI access on every screen that opens a patient's record. |
| Not yet in place | Disk and backup encryption; off-site backups; alerting (component health is recorded about once a minute and shown on the public status page, but nothing notifies a person); an adopted risk analysis, security policies, workforce training and incident procedure (all drafted 2026-10-01, none adopted); a list of subcontractors and their BAAs; penetration testing. |
| Available | A Business Associate Agreement template - read the BAA page before relying on it. |
| Not claimed | No HIPAA certification exists to hold. No SOC 2 report is held, and no audit has been engaged yet. No HITRUST certification is held. |
Technical safeguards (164.312)
| Field or control | What it means |
|---|---|
| Unique user identification | In place. Every user has a named account; shared logins are not supported. |
| Emergency access procedure | Not in place. There is no emergency (break-glass) access path in the application. |
| Automatic logoff | Partial. Sessions end 8 hours after sign-in (12 hours if a non-administrator opts in with Remember me; administrators always 8); there is no inactivity timeout. |
| Encryption and decryption | Partial. Designated PHI fields are encrypted with AES-256-GCM. The database volume and backups are not encrypted. |
| Audit controls | In place, with limits: every screen that opens a patient's record writes the PHI access log, and an automated check fails a release that adds a record screen without it. Browser-built CSV exports and search results are not logged row by row, and nothing alerts on the logs. |
| Integrity | Partial. The application cannot alter or delete audit records; the hash chain reveals a deleted, re-ordered or edited entry - edits only for entries written from 2 October 2026, earlier ones for deletion and re-ordering only. |
| Person or entity authentication | In place. Passwords, Google sign-in, MFA required for administrators, lockout after 10 failures. |
| Transmission security | In place for public traffic: TLS 1.2 or later at the edge, HSTS, an encrypted tunnel to the application host. |
Administrative safeguards (164.308)
| Field or control | What it means |
|---|---|
| Risk analysis and risk management | Drafted 2026-10-01; not adopted. |
| Assigned security responsibility | Not yet designated. |
| Workforce security and training | Policy drafted; no training has taken place. |
| Information access management | Partial. Role-based access and an empty-by-default operator allowlist; no periodic access review yet. |
| Security incident procedures | Drafted; not adopted. |
| Contingency plan | Partial. A daily database backup kept 14 days on the same host, unencrypted, with no off-site copy; one restore rehearsed into a test database on 1 October 2026; plan drafted, not adopted. |
| Business associate contracts | ArkCloud has not yet listed its own subcontractors that handle PHI or put BAAs in place with them. |
Physical safeguards (164.310)
ArkCloud is delivered only as a hosted service, so physical safeguards for the hosting site are ArkCloud's responsibility. The service runs on a single virtual machine operated by ArkCloud, not in a third-party data centre with its own attestation. Facility access controls, workstation standards and media disposal procedures are not yet documented.
Breach notification
As your business associate, ArkCloud must notify you of a breach of unsecured PHI without unreasonable delay and no later than 60 days after discovery, or sooner if your BAA requires it. Notifying affected individuals, HHS and, where required, the media is your obligation as the covered entity unless the BAA delegates it. See incident response for how to report a concern.
Privacy Rule requests
ArkCloud has no built-in report for an accounting of disclosures and no written procedure yet for handling access or amendment requests passed to it as your business associate. Agree how these will be handled in the BAA.
What remains yours
- Your own risk analysis, policies, workforce training and sanction policy.
- Deciding who in your organisation gets which role, and reviewing it.
- Workstation security, including screen locks, since ArkCloud has no inactivity timeout.
- Notifying patients and regulators of a breach, unless the BAA delegates it.