Designed for health information from day one.
HiveCare is a communication platform for home-health agencies. We handle protected health information (PHI), so security is not a layer on top — it is the architecture. We act as each agency’s HIPAA Business Associate and sign the corresponding Business Associate Agreement (BAA).
Encryption everywhere
- At rest: Messages, attachments and sensitive fields are encrypted with AES-256-GCM before they touch the database or disk.
- In transit: All traffic travels over TLS, with HSTS and strict security headers in production.
- Voice calls are never recorded or stored.
An audit trail that cannot be turned off
Every PHI access — logins, reads, downloads, changes — lands in an append-only, hash-chained audit log. There is no switch to disable it, and an automated job verifies its integrity every day: any tampering raises an alert.
Least access, strong identity
- Individual accounts with per-organization roles (RBAC) and full isolation between agencies (multi-tenant).
- Passwords stored as bcrypt hashes with a complexity policy; lockout after failed attempts.
- An unrecognized device requires an email verification code, and the owner is notified of every new sign-in.
- Critical actions (deleting accounts, exporting records) require re-entering the password, sudo-style.
- Idle sessions expire automatically; every user can review and close their sessions and devices.
Responsible retention and deletion
- Attachments are securely disposed of when their retention period ends, preserving the audit trail.
- Per-organization legal hold support.
- Patient right of access (§164.524): the agency can export a client’s full record to hand to them.
- Users can delete their account from the app through a verified, retention-compliant process.
Infrastructure
Hosted on Google Cloud; payments via Stripe (we never store card numbers); push notifications carry no health information. We do not sell data or show ads.
An honest note on HIPAA
There is no official “HIPAA certification” — be wary of anyone advertising one. What does exist are the technical safeguards the rule requires, and every claim on this page corresponds to a real, verifiable mechanism in our platform. Your agency can request the technical summary for auditors and
a signed BAA at support@hivecareapp.com.
