HIPAA & PHI Handling Notice

Last reviewed: August 20, 2026 — Draft for legal review

This platform supports care coordination and administrative decision-making. It does not replace the independent clinical judgment of a qualified healthcare professional.

AOR ONE™ CARE AUTHORITY is designed to support care coordination and administrative workflows. Before any protected health information (PHI) is entered into the system, a Business Associate Agreement (BAA) must be executed between AOR Medical Solutions and the covered entity or business associate responsible for that information.

Safeguards in place

• Multi-tenant isolation: every record is scoped to an organization through Row Level Security (RLS) at the database layer.
• Role-based access: 13 operational roles enforce least-privilege access; no user can see PHI outside their organization or role.
• Immutable audit trail: access and actions are logged in an append-only audit log for compliance review.
• Encryption in transit: all traffic uses TLS 1.2+.
• Multi-factor authentication: required by organizational policy for all production accounts.

What we do not do yet

The platform currently operates in a demonstration environment with synthetic data. Live EHR/FHIR integrations, payer portals, fax/SMS gateways and carrier tracking are disabled until configured and authorized under a signed BAA.

Your responsibilities

• Execute a BAA before loading PHI.
• Assign roles using the principle of least privilege.
• Train workforce members on authorized use.
• Report suspected incidents to the security contact listed on /vulnerability.

This notice does not constitute legal advice or a certification of HIPAA compliance. Have your legal and compliance counsel review it before production use.

AOR ONE™, CARE AUTHORITY™, AOR HealIQ™ and associated systems are proprietary platforms and intellectual property of AOR Medical Solutions.