How Hypernova AI implements HIPAA safeguards and supports healthcare customers
Hypernova AI Inc. is a general-purpose business AI platform and is not itself a Covered Entity under HIPAA. If customers choose to use Hypernova AI to process Protected Health Information (PHI), this policy describes the safeguards implemented and the steps required to operate in compliance. Customers who are Covered Entities or Business Associates must execute a Business Associate Agreement (BAA) with Hypernova AI before processing PHI through our platform.
The following technical safeguards required under 45 CFR § 164.312 are implemented:
| Safeguard | Standard | Implementation |
|---|---|---|
| Unique User Identification | § 164.312(a)(2)(i) | Every user assigned a unique account ID — shared accounts prohibited |
| Automatic Logoff | § 164.312(a)(2)(iii) | Sessions expire after 30 days of inactivity |
| Audit Controls | § 164.312(b) | Full audit logging of all auth events, data access, and admin actions with timestamp, user ID, and IP |
| Integrity Controls | § 164.312(c)(1) | bcrypt hashing for passwords, database constraints, application-layer integrity checks |
| Transmission Security | § 164.312(e)(1) | TLS 1.3 on all data in transit, HSTS preload, certificate pinning considered |
| Encryption at Rest | § 164.312(a)(2)(iv) | Planned. Today only connected social account tokens are encrypted with AES-256. |
| Safeguard | Standard | Implementation |
|---|---|---|
| Security Officer | § 164.308(a)(2) | Cale McMillin, CEO — designated Security Officer responsible for HIPAA compliance |
| Workforce Training | § 164.308(a)(5) | Security policies documented and reviewed by all team members annually |
| Risk Analysis | § 164.308(a)(1)(ii)(A) | Annual risk assessment documented, identifying threats and vulnerabilities to PHI |
| Access Management | § 164.308(a)(4) | Role-based access control per Access Control Policy |
| Contingency Plan | § 164.308(a)(7) | Data backup procedures, disaster recovery, incident response per IRP |
| Business Associate Management | § 164.308(b) | Service providers listed on our Security page; BAAs with them not yet in place |
| Safeguard | Standard | Implementation |
|---|---|---|
| Facility Access Controls | § 164.310(a)(1) | Hosted on IONOS servers; physical datacenter security is provided by IONOS |
| Workstation Security | § 164.310(b) | Developer workstations require encrypted disks; no PHI stored locally |
| Device Controls | § 164.310(d)(1) | Cloudflare Tunnel eliminates open ports on origin — no direct network access to servers |
If you are a Covered Entity (healthcare provider, health plan, or healthcare clearinghouse) or a Business Associate and intend to process Protected Health Information through Hypernova AI services, you must execute a BAA with us before doing so.
To request a BAA, contact: [email protected]
We are working toward HIPAA compliance and don't yet have business associate agreements (BAAs) with our own providers. Please don't store patient health information in our products until we announce that we're ready. Questions: [email protected].
Contact our Security Officer to initiate a BAA or discuss HIPAA requirements
[email protected]| Version | Date | Author | Changes |
|---|---|---|---|
| 1.0 | January 1, 2026 | Cale McMillin | Initial document |
| 1.0.1 | August 2026 | Cale McMillin | Annual review — added BAA request section |