AlayaCare

AlayaCare is SOC 2 Type II compliant. On SOC2C this listing is Listed.

According to AlayaCare's public trust center, AlayaCare is HIPAA compliant. On SOC2C this listing is Listed.

According to AlayaCare's public trust center, AlayaCare is HITRUST certified. On SOC2C this listing is Listed.

According to AlayaCare's public trust center, AlayaCare is CSA STAR certified. On SOC2C this listing is Listed.

AlayaCare is SOC 2 Type II compliant. A Type II report covers how security controls operated over a period (typically 3 to 12 months), a stronger signal than a point-in-time Type I.

AlayaCare's SaaS platform maintains audit logs and audit trails of (i) a comprehensive set of user activities performed in the application, and (ii) access to the application within the secure infrastructure of the Customer's AWS instance/tenant. As audit logs and trails become a bigger part of healthcare and privacy regulation, AlayaCare takes a comprehensive but user-driven approach to many audit inquiries. Via in-app clinical functions, user can audit activities along with changes to user roles and permissions. This overview of the elements of AlayaCare's capabilities can serve as a baseline from which Customers can map to their specific requirements and use cases. Some additional configurations can be implement upon request by AlayaCare's professional services and data management teams. More detailed information can be access through this requestable document: https://trustcenter.alayacare.com/resources?s=jp6i11wg5fbz8rmjsagkn&name=alayacare-core-audit-logging-and-related-capabilities-xlsx

AlayaCare supports all SAML 2.0 Identity Providers for Single Sign-On (SSO)

AlayaCare’s Privacy Policies describe how we address the privacy and security of the data and other information entrusted to us: - by our customers through their access and use of the AlayaCare electronic health record platform; - by our business partners and specific third-party providers of key services to us; and - by everyone else, including partners, prospective customers, and those who seek information or contact us through our website.

Overview Privacy and data protection practices at AlayaCare complement the core security infrastructure and tools that ensure the integrity of the personal and protected health information in AlayaCare's custody. Using a shared-responsibility model, individual consents and requests for access are managed by AlayaCare's customers. AlayaCare, in its capacity as a business associate or data custodian, assumes responsibility for the integrity and redundancy of the data in its secure, AWS cloud-based infrastructure. A data map sets out the key flows of information in and out of the AlayaCare infrastructure; https://trustcenter.alayacare.com/resources?s=si6ekbq9ejdwf3031zoxur&name=overview-of-alayacare-system-architecture-diagram-png Privacy Impact Assessments (PIAs) Assessing the impact of its products and services on the privacy and data of customers is an important component of AlayaCare's approach to safeguarding patient data and maintaining compliance with privacy regulations. AlayaCare's PIA serves as an important evaluation of its data management practices and their impact on privacy. By conducting a thorough assessment, AlayaCare can identify and address potential privacy risks associated with its EHR platform and its key functional capabilities. This proactive approach allows AlayaCare to ensure that the confidentiality, integrity, and availability of the health information maintained in our platform are effectively protected. Key benefits of AlayaCare’s PIAs include: 1. Privacy Compliance: A PIA enables AlayaCare to assess its compliance with applicable privacy laws and regulations, such as the Health Insurance Portability and Accountability Act (HIPAA) in the United States and the Personal Health Information and Protection Act (PHIPA) in Ontario. By conducting a PIA, AlayaCare can identify any gaps in compliance and implement necessary measures to meet regulatory requirements. 2. Risk Identification and Mitigation: The PIA process helps AlayaCare to identify…

AlayaCare's electronic health records platform uses a variety of tools and mechanisms to achieve high availability and resiliency. Its infrastructure spans multiple fault-independent AWS availability zones in geographic regions physically separated from one another. AlayaCare’s infrastructure is able to detect and route around issues experienced by hosts or even whole data centers in real-time and employ orchestration tooling that has the ability to regenerate hosts, building them from the latest backup. AlayaCare also leverages specialized tools that monitor server performance, data, and traffic load capacity within each availability zone and colocation data center. If sub-optimal server performance or overloaded capacity is detected on a server within an availability zone or colocation data center, these specialized tools increase the capacity or shift traffic to relieve any suboptimal server performance or capacity overload. AlayaCare is also immediately notified in the event of any sub-optimal server performance or overloaded capacity.