HIPAA & Security
Dischargo is built with a HIPAA-conscious architecture: hospital-level data isolation, role-based access, and a full audit trail on every action, from day one. HIPAA compliance is a shared responsibility between Dischargo and each hospital we work with, formalized through a signed Business Associate Agreement — not a badge we award ourselves.
We'd rather tell you exactly what's built, what's still in progress, and what a BAA actually commits us to, than make a blanket claim you'd have to take on faith.
What's built today
Access Control
Role-based access (Admin, Nurse, Viewer) scoped to each hospital's account. One facility's staff cannot query or modify another facility's patient data under any circumstance — enforced on every request, not just in the UI.
Audit Logging
Every view, edit, and deletion of a patient record, every alert acknowledgment, and every login is written to an immutable audit log — capturing the user, the action, and a timestamp.
Encryption
All data in transit is encrypted via TLS. Data at rest is encrypted at the database layer (PostgreSQL via Supabase, AES-256).
Verified Integrations
Every inbound webhook — patient replies, billing events — verifies a cryptographic signature before any data is processed, rejecting anything that isn't provably from the real source.
In progress — not done yet
- A formally BAA-eligible messaging path for U.S. patient PHI sent over WhatsApp — we're evaluating WhatsApp Business Solution Providers that offer this.
- An independent third-party penetration test — not yet commissioned.
Business Associate Agreement
We have a Business Associate Agreement ready for review. For a U.S. hospital, signing a BAA is a prerequisite before any Protected Health Information is processed through Dischargo — we treat it as a requirement, not a formality.
Questions
For anything about our security architecture, a BAA, or a data processing agreement, contact us at hello@dischargo.com.