Question 1

Is Intel e-medix HIPAA compliant?

Accepted Answer

Intel e-medix operates on HIPAA-aligned infrastructure with the administrative, physical, and technical safeguards required by the HIPAA Security Rule. We sign Business Associate Agreements (BAAs) with organizations that process PHI through our platform.

Question 2

Do you sign a Business Associate Agreement (BAA)?

Accepted Answer

Yes. We offer a standard BAA to qualified covered entities and business associates. Once signed, your organization can process PHI through Intel e-medix with the contractual safeguards required by 45 CFR §164.504(e). Contact compliance@intelemedix.com to begin the process.

Question 3

What does the BAA cover?

Accepted Answer

Our BAA covers permitted uses and disclosures, safeguards against unauthorized PHI access, breach notification timelines, subcontractor flow-down, return or destruction of PHI on termination, and audit rights. It mirrors HHS sample BAA language so legal review is fast.

Question 4

How is my data encrypted?

Accepted Answer

All data is encrypted in transit using TLS 1.3 and at rest using AES-256. Encryption keys are managed in a FIPS 140-2 validated key management service with periodic rotation. No file or analysis is ever stored in plaintext.

Question 5

How long do you retain my reports?

Accepted Answer

By default, uploaded files and generated analyses are cryptographically erased 48 hours after upload. Organizations with active BAA contracts can configure extended retention windows for clinical workflow needs — all retention periods are documented and auditable.

Question 6

Do you use my reports to train models?

Accepted Answer

No. We do not use customer reports to train, fine-tune, or improve any external or third-party models. Your data is processed solely to produce your analysis and is then auto-purged according to your retention policy.

Question 7

Who at Intel e-medix can see my reports?

Accepted Answer

By default, no employee can read your reports. Engineering access is restricted to a small on-call team, gated by multi-factor authentication, and triggered only when you explicitly open a support ticket and grant access. All access is logged in the tamper-evident audit trail.

Question 8

Do you support SSO and role-based access?

Accepted Answer

Yes. Enterprise plans include SAML 2.0 single sign-on, SCIM provisioning, and granular role-based access control with per-report visibility scopes. We integrate with Okta, Azure AD, Google Workspace, and any standards-compliant identity provider.

Question 9

Is every access to my data logged?

Accepted Answer

Yes. Every read, share, export, and delete operation is recorded in a tamper-evident audit log with user, timestamp, IP address, and action. Organizations can export the audit log at any time for internal compliance review.

Question 10

Who are your subprocessors?

Accepted Answer

We publish a complete subprocessor list including cloud infrastructure, monitoring, and email providers. All subprocessors are bound by data processing agreements that meet or exceed our own commitments. The list is updated whenever a subprocessor is added or removed, and BAA customers receive advance notification.

Question 11

What happens in the event of a breach?

Accepted Answer

We follow HIPAA breach notification timelines: documented internal investigation, notification to affected covered entities within 60 days, and assistance with regulatory and patient notification as required by §164.404–§164.410. Our incident response plan is reviewed annually.

Question 12

Where is my data hosted?

Accepted Answer

All production data is hosted in HIPAA-eligible cloud regions in the United States by default. Multi-region deployments are available for enterprise customers with specific data residency requirements.

Question 13

Can I delete my data on demand?

Accepted Answer

Yes. You can delete any uploaded report and its analysis at any time from your dashboard, and the underlying objects are cryptographically erased within 24 hours. For full account deletion, contact privacy@intelemedix.com and we will purge all associated records within the timelines specified in our privacy policy.

Question 14

Can I export my data?

Accepted Answer

Yes. Every report and its full analysis can be exported as PDF or structured JSON from your dashboard at any time. There is no lock-in and no export fee.

Security & BAA FAQ