Overview
HANA maintains enterprise-grade security standards with comprehensive compliance certifications, including SOC 2 Type II, HIPAA, and GDPR. Our platform leverages cloud infrastructure to provide robust encryption, secure communications, and continuous monitoring, ensuring optimal data protection for healthcare customers.Compliance Certifications
Security Architecture
Multi-layered Defense Strategy
Our cyber-intelligence framework implements multiple layers of defense to ensure comprehensive protection:- Perimeter Security: Advanced threat detection at network boundaries using intrusion detection/prevention systems
- Infrastructure Security: Hardened cloud infrastructure with restricted access controls
- Application Security: Secure development practices with regular code audits and vulnerability assessments
- Data Security: End-to-end encryption with sophisticated key management
- Operational Security: Continuous monitoring with real-time alerts and automated remediation
Data Encryption
All data within the HANA platform is protected using industry-leading encryption standards:- Storage Encryption: AES-256 with cloud-managed encryption keys
- Communication Encryption: TLS 1.3 enforced for all traffic
- Key Management: Cloud KMS integration with strict access controls
- PHI Protection: Special handling for protected health information with additional encryption layers
Network Security
- Protocol Security: HTTPS enforced across all endpoints
- SSL Configuration: Comprehensive SSL certificate deployment
- Traffic Protection: End-to-end encrypted communications
- API Security: Rate limiting, token-based authentication, and request validation
Service Architecture Integration
HANA’s cyber-intelligence capabilities are deeply integrated with our service architecture:- Service Mesh Security: Secure service-to-service communication with mutual TLS
- Zero Trust Implementation: Verification of every request regardless of source
- Centralized Policy Enforcement: Consistent security policies across all services
- Observability: Comprehensive logging and monitoring for security events
AI-Specific Security Controls
Model Safety Mechanisms
HANA implements specialized security controls for AI components:- Input Sanitization: Advanced filtering to prevent prompt injection and other attacks on conversation engine
- Output Monitoring: Automated content scanning for sensitive information leakage in voice responses
- Runtime Isolation: Containerized execution environments for model inference
- Model Versioning: Strict version control with cryptographic verification for all model artifacts
- AI Vulnerability Management: Dedicated monitoring for AI-specific threats
LLM Safety Framework
- Jailbreak Prevention: Constrained generation architecture prevents conversation engine from operating outside protocol boundaries
- Continuous Validation: Automated testing against known attack vectors for voice AI systems
- Red Team Exercises: Regular adversarial testing focused on clinical AI vulnerabilities
- Content Filtering: Multi-stage filtering for harmful or clinically inappropriate outputs
Security Controls Framework
HANA maintains a comprehensive security controls framework across multiple domains: Access Control & Authorization (30+ Controls)- Comprehensive access control procedures
- Infrastructure modification restrictions
- Regular access reviews and audits
- Role-based access control with least privilege principles
- Comprehensive data protection procedures
- Anonymization and pseudonymization processes
- Data retention and disposal policies
- Secure data transfer mechanisms
- Incident response procedures
- Risk assessment frameworks
- Vendor risk management
- Business continuity planning
- Application monitoring and alerting
- Asset management procedures
- Disaster recovery planning
- Change management processes
EU AI Act Compliance
The European Union’s AI Act classifies AI systems that affect access to healthcare as high-risk applications. This includes AI systems involved in patient triage, clinical decision support, prior authorization, and any scenario where an AI output could influence a patient’s access to care.Current Status
HANA is actively working toward full EU AI Act compliance for healthcare deployments in Europe:- Risk classification assessment: Mapping HANA’s capabilities against the AI Act’s high-risk categories to determine registration requirements per use case
- Conformity assessment preparation: Documenting technical architecture, safety measures, and quality management systems required for high-risk AI registration
- EU database registration: Preparing for registration in the EU database of high-risk AI systems as required before production deployment with EU patients
Use Case-Specific Classification
Not all HANA deployments carry the same regulatory classification under the AI Act:What This Means for EU Customers
- Non-high-risk use cases (appointment management, preparation reminders, general outreach) can proceed under standard GDPR compliance
- High-risk use cases (anything involving clinical decisions that affect care access) require HANA to be registered in the EU AI Act database before production deployment — including POC/pilot phases with live patients
- HANA works with EU customers during scoping to classify the intended use case and determine the regulatory pathway
For EU healthcare organizations evaluating HANA: we recommend discussing your intended use case during the scoping phase so we can provide a clear regulatory timeline. Some use cases can proceed immediately; others require registration that we are actively pursuing.
Contact Information
For security inquiries or compliance requests:- Security Team Email: security@hana.health
- Response Time: Standard business hours
- Documentation Access: Available upon request through our trust center