How HiveCare Protects Your Data

HiveCare is designed with security as a core part of the platform architecture. Because HiveCare processes protected health information (PHI) for home-health agencies, security measures are built into how the service stores, processes, and protects information.

HiveCare acts as each agency’s HIPAA Business Associate and processes protected health information according to the instructions of the organization through the applicable Business Associate Agreement (BAA).

Encryption and Data Protection

HiveCare protects sensitive information through encryption:

  • Messages, attachments, and sensitive fields are encrypted at rest using AES-256-GCM before being stored.
  • Data transmitted between users and HiveCare is protected using TLS encryption.
  • Production environments use HSTS and strict security headers.

Voice calls are handled in real time. Audio is never recorded or stored.

Access Control

HiveCare uses security controls designed to limit access:

  • Each user has an individual account.
  • Access is controlled through organization-based roles and permissions.
  • Organizations are isolated from each other.
  • Users only access information allowed by their assigned role.

Security Monitoring

HiveCare maintains security records to protect sensitive information:

  • Login activity.
  • PHI access events.
  • Reads.
  • Downloads.
  • Changes.
  • Session and device information.

All PHI access is recorded in an append-only, hash-chained audit log. Audit logging cannot be disabled, and an automated process verifies its integrity every day.

Infrastructure Protection

HiveCare infrastructure includes:

  • Google Cloud hosting.
  • Stripe payment processing without storing card numbers.
  • Push notifications that do not contain health information.

HiveCare does not sell user data or use information for targeted advertising.