Trust
Security and HIPAA
How Careforce protects member data.
Careforce acts as a HIPAA business associate. We sign a Business Associate Agreement (BAA) with every customer before we handle any protected health information.1
Certifications
Careforce holds a SOC 2 Type II report on the Security criteria, issued by an independent CPA firm. Customers and prospects can request the report and our bridge letter under NDA.
Data handling
| Control | Summary |
|---|---|
| Location | Member data is processed and stored only in the United States |
| Encryption | Encrypted in transit with TLS and encrypted at rest |
| Separation | Each customer's data is kept logically separate |
| Access | Role-based, least-privilege access with multi-factor authentication |
| Audit | Access, changes and exports are logged |
| File transfer | Secure file transfer with key-based authentication |
| Minimum necessary | Each duty reads only the fields it needs2 |
| Retention | Set to your policy, with secure disposal |
| Deletion | Data is deleted within 30 days of a valid request, or as set in your agreement. You can export your data first |
People and vendors
- Every employee completes HIPAA and security training each year and signs a confidentiality agreement.
- Employees pass a background check before they get access.
- Vendors that touch customer data must hold a current SOC 2 report and sign a BAA.
Testing and resilience
- An independent firm tests our systems every year.
- We keep encrypted backups in US regions and test the disaster recovery plan every year.
- We keep documented incident response and business continuity plans. Customers are notified of incidents within the time set in their BAA.
Running a security review?
Ask your account team for our security documentation and questionnaire responses.