Security

Encryption

All data transmitted to and from HIPAA.app is encrypted using industry-standard TLS/SSL protocols. This ensures that your search queries and results cannot be intercepted or read by unauthorized parties during transmission.

Secure Session Management

We implement secure session handling with automatic timeouts, secure cookie settings, and protection against session fixation attacks. Your session data is encrypted and managed securely throughout your interaction with our service.

Infrastructure Security

Our application is hosted on secure cloud infrastructure with multiple layers of protection, including firewalls, intrusion detection systems, and regular security updates. We follow security best practices in our deployment and maintenance processes.

Rate Limiting

To prevent abuse and ensure service availability for all users, we implement rate limiting on searches. Each IP address is limited to 10 searches per hour and 50 searches per day.

CSRF Protection

We implement Cross-Site Request Forgery (CSRF) protection to prevent attackers from tricking users into performing unwanted actions. All form submissions are validated with secure tokens to ensure they originate from legitimate users.

Input Validation

All user inputs are thoroughly validated and sanitized to prevent injection attacks and other security vulnerabilities. We follow secure coding practices to ensure that our application is resilient against common web application attacks.

HIPAA Considerations

While HIPAA.app is designed as a tool to help identify potential PHI exposure, we are not a Covered Entity or Business Associate as defined by HIPAA. Our "zero storage" approach means we do not store, process, or transmit PHI in a persistent manner. However, we still implement security measures that align with HIPAA security principles.

Regular Security Assessments

We conduct regular security assessments and vulnerability scanning to identify and address potential security issues. Our security practices are continuously evaluated and improved to address emerging threats.

If you discover a security vulnerability or have concerns about our security practices, please report them immediately to our security team. We take all security reports seriously and will investigate promptly.

Security Contact: security@hipaa.app

We appreciate the work of security researchers who help us maintain and improve the security of our service. We commit to acknowledging reports within 48 hours and providing updates on our investigation and remediation efforts.