Skip to main content

Security is the architecture, not a checklist.

SmartTPA administers protected health information, so every layer — storage, transport, access, and audit — was built for the 2026 HIPAA Security Rule from the first commit. Here is what that means in practice.

Built to meet the strictest healthcare standards

  • HIPAA Aligned
    2026 Security Rule
  • Security-First Architecture
    SOC 2 in progress
  • AES-256 Encryption
    At rest & in transit
  • Immutable Audit Logs
    7-year retention
  • Clearinghouse-Ready EDI
    Claims in, remittances out

The controls behind every claim we touch.

Encryption everywhere

AES-256-GCM encryption at rest with KMS-managed keys, plus field-level envelope encryption on the most sensitive PHI columns — SSNs, dates of birth, banking details. TLS 1.2+ for every connection in transit.

Immutable audit logging

Every access to protected health information is logged to append-only, write-once storage and retained for seven years. Audit logging is a boot-time requirement — the platform refuses to serve traffic if the audit pipeline is down.

AWS infrastructure

The platform runs on AWS with a multi-AZ database, automated failover, encrypted backups, and infrastructure managed as code so every security setting is reviewable and reproducible.

Access control

Role-based access with least privilege, multi-factor authentication, short-lived sessions, and scheduled access reviews. Per-tenant isolation is enforced at the data layer — one employer's data is never visible to another.

Monitoring & detection

Control-plane activity is captured in tamper-evident audit trails with automated alerting on anomalous patterns — failed-login bursts, after-hours administrative activity, and mass-export attempts page a human.

Secure development

Static and dynamic security analysis run in CI, dependencies are scanned continuously, and changes ship through review gates. Security regressions are blocked before merge, not patched after deploy.

Compliance posture — stated plainly

  • HIPAA. The platform is built to the 2026 HIPAA Security Rule, under which every safeguard is mandatory. We sign Business Associate Agreements with every plan we serve and with every subprocessor that could touch regulated data — the full list is on our subprocessors page.
  • SOC 2. A SOC 2 Type II examination is in progress. We say “in progress” because that is the truth — we will publish the report when it is complete, and we share our security documentation under NDA during evaluation in the meantime.
  • Data handling. No sale of data, ever. No PHI in application logs. Member data is exportable in standard formats, and plan data leaves with the plan if the relationship ends.

Reporting a vulnerability

We welcome good-faith security research. Report suspected vulnerabilities to support@smarttpa.com with “Security report” in the subject line. Include enough detail to reproduce the issue; we acknowledge reports within two business days and will not pursue action against researchers acting in good faith.

Security you can verify

Evaluating SmartTPA for a health plan?

Request our security documentation under NDA, or start a conversation with our team.

Request a Proposal See How It Works