Security & Data Handling
HCC Buddy does not store, transmit, or log any Protected Health Information (PHI). Zero patient data enters our systems.
Architecture Overview
HCC Buddy uses a three-tier architecture designed to keep sensitive data out of our systems entirely:
Layer 1
Chrome Extension / Website
Your browser
Layer 2
API Server
Fly.io, US East
Layer 3
Database
Supabase PostgreSQL
Your browser sends only ICD-10 codes and search terms to our API — never patient names, member IDs, or clinical notes.
What We Protect
No PHI Storage
No patient names, member IDs, dates of birth, Social Security Numbers, or Medicare Beneficiary Identifiers are ever stored in our database, logs, or backups.
PHI Upload Scanning
Built-in scanner automatically rejects any uploaded PDF containing SSNs, MBIs, patient names, or dates of birth.
Encryption in Transit
All data transmitted over HTTPS/TLS. Our API enforces HSTS (HTTP Strict Transport Security).
Encryption at Rest
Sensitive fields (MFA secrets) encrypted with AES-128-CBC + HMAC-SHA256 (Fernet). Passwords hashed with bcrypt.
Session Security
15-minute access tokens, single-session enforcement, and automatic account lockout after 5 failed login attempts.
Audit Logging
All sensitive actions logged to a HIPAA-conscious audit trail with 6-year retention.
HIPAA Disclaimer
HCC Buddy is not a HIPAA covered entity as defined under the Health Insurance Portability and Accountability Act (HIPAA).
- No Business Associate Agreement (BAA) is required or offered.
- “HIPAA-conscious” design means our architecture actively prevents Protected Health Information from entering our systems — not that we are a HIPAA covered entity.
- Built-in PHI scanning rejects uploads containing patient names, Social Security Numbers, Medicare Beneficiary Identifiers, or dates of birth.
- Users are solely responsible for ensuring they do not submit PHI through any feature of the Service.
Third-Party Security
Reporting Security Issues
If you discover a security vulnerability, please report it responsibly. We welcome and appreciate responsible disclosure.
Email: privacy@hccbuddy.com