HIPAA & Security

ContinuaOS is a multi-tenant platform purpose-built for hospice and post-acute care organizations — customers who operate under the HIPAA Privacy and Security Rules, Medicare Conditions of Participation, and state licensing requirements. The data the platform handles includes Protected Health Information, employee records, and operational business data. Security is a foundational design principle of the platform rather than a later addition.

The platform runs entirely on Amazon Web Services, a HIPAA-eligible cloud environment, under an executed Business Associate Agreement with AWS.

All data in transit is protected with TLS — 1.2 minimum, 1.3 preferred — and HTTPS is enforced at the public edge. Database connections are encrypted in transit, and the database server requires TLS.

All data at rest — database records, file attachments, and backups — is encrypted with AES-256 using keys managed by AWS Key Management Service.

Passwords are handled entirely by AWS Cognito. The ContinuaOS application never receives, stores, or hashes a password.

Every record that belongs to a customer organization carries that organization, and tenant isolation is enforced by PostgreSQL Row-Level Security at the database engine, not solely at the application layer. A fault in the application’s own tenant-scoped query path therefore cannot read across organizations: the database refuses it.

Privileged server-side operations — scheduled jobs, platform administration, work that deliberately spans members of one organization, and a small number of public intake endpoints that write no customer data — run under a separate database role that is exempt from those policies, because the work could not be done otherwise. That role is never used to serve a customer session: it is reached only from named server code paths, and the paths that read or write customer records check the caller’s authorization before using it. Platform-level data that belongs to no customer organization, such as submissions from the public contact and demo forms, is held in tables that no tenant role can read at all.

Above that sits role-based access control scoped to hospice roles, default permissions that are the most restrictive available, and signed session tokens that expire. Passkeys and TOTP are available on every account. Internal ContinuaOS engineering and support access to production is controlled through AWS IAM, limited to operational necessity, and logged.

ContinuaOS keeps a time-stamped record of security-relevant activity: sign-in and sign-out, credential and multi-factor changes, record and report access, record creation and modification, and administrative actions such as invitations and role changes. Certain refused operations are recorded by the operations that refuse them. Each entry captures who acted, in which organization, on which resource, and when. Infrastructure-level API activity is captured separately by AWS CloudTrail.

Audit entries are held in a table owned by a database role that cannot sign in, and the permissions to update, delete or truncate them are withheld from every role the application uses, and from every role the deployment pipeline uses except the database’s own master account, which the migration step runs as. The timestamp is set by the database rather than by the caller. The master account cannot be excluded, because on Amazon RDS an account cannot be stripped of access to a table in its own database.

ContinuaOS executes a Business Associate Agreement with each Covered Entity customer before any Protected Health Information is processed on that customer’s tenant. Our Business Associate Agreement and our detailed Security Overview are available to customers and prospective customers on request.

An independent third party is conducting a HIPAA Security Rule risk assessment of ContinuaOS. Fieldwork is underway. We will share the outcome with customers and prospective customers when it is delivered.

We describe controls that are operating today as operating today, and work that is still underway as underway. Where a control is planned rather than live, the Security Overview says so plainly rather than leaving it to be inferred.

Security questions and incident reports

security@continuaos.com

Privacy questions and individual rights requests

privacy@continuaos.com

See also our Privacy Policy and Terms of Service.