HIPAA & Security

ContinuaOS is a multi-tenant platform purpose-built for hospice and post-acute care organizations — customers who operate under the HIPAA Privacy and Security Rules, Medicare Conditions of Participation, and state licensing requirements. The data the platform handles includes Protected Health Information, employee records, and operational business data. Security is a foundational design principle of the platform rather than a later addition.

The platform runs entirely on Amazon Web Services, a HIPAA-eligible cloud environment, under an executed Business Associate Agreement with AWS.

All data in transit is protected with TLS — 1.2 minimum, 1.3 preferred — and HTTPS is enforced at the public edge. Database connections are encrypted in transit, and the database server requires TLS.

All data at rest — database records, file attachments, and backups — is encrypted with AES-256 using keys managed by AWS Key Management Service.

Passwords are handled entirely by AWS Cognito. The ContinuaOS application never receives, stores, or hashes a password.

Every record belongs to exactly one organization, and tenant isolation is enforced by PostgreSQL Row-Level Security at the database engine — not solely at the application layer — so cross-tenant access is structurally prevented at the database tier even in the event of an application-layer fault.

Above that sits role-based access control scoped to hospice roles, default permissions that are the most restrictive available, and signed session tokens that expire. Passkeys and TOTP are available on every account. Internal ContinuaOS engineering and support access to production is controlled through AWS IAM, limited to operational necessity, and logged.

ContinuaOS keeps a time-stamped record of security-relevant activity: sign-in and sign-out, credential and multi-factor changes, record and report access, record creation and modification, administrative actions such as invitations and role changes, and security events such as failed authorization attempts. Each entry captures who acted, in which organization, on which resource, and when. Infrastructure-level API activity is captured separately by AWS CloudTrail.

ContinuaOS executes a Business Associate Agreement with each Covered Entity customer before any Protected Health Information is processed on that customer’s tenant. Our Business Associate Agreement and our detailed Security Overview are available to customers and prospective customers on request.

An independent third party is conducting a HIPAA Security Rule risk assessment of ContinuaOS. Fieldwork is underway. We will share the outcome with customers and prospective customers when it is delivered.

We describe controls that are operating today as operating today, and work that is still underway as underway. Where a control is planned rather than live, the Security Overview says so plainly rather than leaving it to be inferred.

Security questions and incident reports

security@continuaos.com

Privacy questions and individual rights requests

privacy@continuaos.com

See also our Privacy Policy and Terms of Service.