HIPAA built into Arintra's architecture

Before access is granted, every Arintra contract includes a signed BAA. It defines allowed PHI use, code assignment only, no retention after processing, and breach notification duties.

Clinical notes run through temporary compute and are discarded once the code set returns. Arintra does not create a patient record database. Only anonymized aggregate performance metrics persist.

Data sent between your EHR and Arintra's processing layer uses TLS 1.3 encryption. Temporary buffers containing chart data use AES-256 encryption and are cleared when processing ends.

Arintra asks only for FHIR scopes needed for code assignment: read access to encounter, observation, condition, and procedure resources. Writes are limited to coding-specific resource types. Billing history, scheduling, and demographic scopes are not requested.

Each API call Arintra makes to your EHR records a timestamp, encounter ID, and operation type. Your compliance team may request these logs, which default to 90 days of retention.

Arintra operates on HIPAA-eligible cloud infrastructure covered by a separate BAA with its provider. Every processing pipeline service remains inside this HIPAA-covered boundary.