> ## Documentation Index
> Fetch the complete documentation index at: https://docs.veridianhp.com/llms.txt
> Use this file to discover all available pages before exploring further.

# HIPAA

> HIPAA-aligned design for Veridian Motion — not certification.

# HIPAA

Veridian Health Partners processes Protected Health Information (PHI) on
behalf of covered entities. Veridian operates as a **Business Associate** when
a signed **BAA** is in place.

<Warning>
  **HIPAA-aligned design is not HIPAA certification.** Veridian Motion is
  **not HIPAA-certified**. Compliance depends on BAAs, agency hosting, and
  operational practices.
</Warning>

## Technical safeguards (built today)

* Row-level security on every table
* Field-level PHI encryption
* Hash-chained audit log (no PHI in payload)
* Role-based access (`pt`, `admin`, `it_admin`)
* TOTP MFA for staff (enforced per deployment)
* Brute-force login protection

## PHI in Veridian Motion

* Patient identifiers and enrollment records
* Body-map selections, complaint, questionnaire responses
* Posture photos (up to four)
* AI triage output, PT notes, approved exercise plans
* Clinician-to-patient messages

**Minimum necessary:** patients see only their data; plans only after PT
approval; notes only if shared.

## Patient rights

HIPAA rights are exercised through the **covered entity / agency**. Veridian
supplies data to authorized agency staff to fulfill requests.

## Corrections-specific note

**CJIS**, **FedRAMP**, and state corrections IT standards are separate from
HIPAA — **not built into Veridian Motion**. The **hosting agency** provides
CJIS/FedRAMP/GovCloud environment, MDM kiosk lockdown, network controls, and
personnel screening.

## Subprocessors

PHI may be processed by subprocessors including Lovable Cloud / Supabase and
server-side AI providers. List available to customers on request.

## What's next

<CardGroup cols={2}>
  <Card title="Data handling" icon="database" href="/security/data-handling">
    Collection and retention.
  </Card>

  <Card title="Security overview" icon="shield-check" href="/security/overview">
    Full posture.
  </Card>
</CardGroup>