Data Security

Security is foundational to NHCS. This page describes the technical and organizational measures we implement to protect your data.

Encryption

All data is encrypted in transit using TLS 1.2+ and at rest using AES-256. Encryption keys are managed through a dedicated key management service with regular rotation.

Access Control

We implement role-based access control (RBAC) with least-privilege principles. Agency-scoped data isolation ensures users can only access data within their authorized agency. Administrative actions require multi-factor authentication.

Audit and Monitoring

All data access and system actions are logged in immutable audit trails. We maintain real-time monitoring for anomalous access patterns, insider threats, and intrusion attempts.

PHI Shield Suite

Our PHI Shield security suite provides: automatic session lock; screenshot blocking; PHI watermarking; PIN-protected printing and exporting; zero-trust access validation; and geo-fence validation for mobile access.

Infrastructure Security

Our infrastructure is hosted in SOC 2 Type II compliant data centers with physical security controls, environmental monitoring, and redundant systems. We maintain automated daily backups and disaster recovery procedures.

Vulnerability Management

We conduct regular vulnerability assessments, penetration testing, and code security reviews. Critical vulnerabilities are remediated within 24 hours of discovery.

Compliance

NHCS complies with: HIPAA Security Rule; HITECH Act; SOC 2 controls framework; and applicable state privacy laws including CCPA/CPRA.

Incident Response

We maintain a documented incident response plan with defined escalation procedures. Security incidents are classified, investigated, and remediated according to severity.