Overview
HANA maintains enterprise-grade security standards with comprehensive compliance certifications, including SOC 2 Type II, HIPAA, and GDPR. Our platform leverages cloud infrastructure to provide robust encryption, secure communications, and continuous monitoring, ensuring optimal data protection for healthcare customers.
Compliance Certifications
| Certification | Status | Coverage | Scope |
|---|
| SOC 2 Type II | ✅ Audited controls for security, availability, and confidentiality | Complete annual cycle audit | Comprehensive evaluation of trust service principles |
| HIPAA | ✅ Continuously monitored | US healthcare data privacy regulations | Essential for healthcare providers, insurers, and medical technology |
| GDPR | ✅ Continuously monitored | EU personal data protection and privacy | Global compliance for handling EU citizen data with privacy-by-design architecture |
Security Architecture
Multi-layered Defense Strategy
Our cyber-intelligence framework implements multiple layers of defense to ensure comprehensive protection:
- Perimeter Security: Advanced threat detection at network boundaries using intrusion detection/prevention systems
- Infrastructure Security: Hardened cloud infrastructure with restricted access controls
- Application Security: Secure development practices with regular code audits and vulnerability assessments
- Data Security: End-to-end encryption with sophisticated key management
- Operational Security: Continuous monitoring with real-time alerts and automated remediation
Data Encryption
All data within the HANA platform is protected using industry-leading encryption standards:
- Storage Encryption: AES-256 with cloud-managed encryption keys
- Communication Encryption: TLS 1.3 enforced for all traffic
- Key Management: Cloud KMS integration with strict access controls
- PHI Protection: Special handling for protected health information with additional encryption layers
Network Security
- Protocol Security: HTTPS enforced across all endpoints
- SSL Configuration: Comprehensive SSL certificate deployment
- Traffic Protection: End-to-end encrypted communications
- API Security: Rate limiting, token-based authentication, and request validation
Service Architecture Integration
HANA’s cyber-intelligence capabilities are deeply integrated with our service architecture:
- Service Mesh Security: Secure service-to-service communication with mutual TLS
- Zero Trust Implementation: Verification of every request regardless of source
- Centralized Policy Enforcement: Consistent security policies across all services
- Observability: Comprehensive logging and monitoring for security events
AI-Specific Security Controls
Model Safety Mechanisms
HANA implements specialized security controls for AI components:
- Input Sanitization: Advanced filtering to prevent prompt injection and other attacks on conversation engine
- Output Monitoring: Automated content scanning for sensitive information leakage in voice responses
- Runtime Isolation: Containerized execution environments for model inference
- Model Versioning: Strict version control with cryptographic verification for all model artifacts
- AI Vulnerability Management: Dedicated monitoring for AI-specific threats
LLM Safety Framework
- Jailbreak Prevention: Constrained generation architecture prevents conversation engine from operating outside protocol boundaries
- Continuous Validation: Automated testing against known attack vectors for voice AI systems
- Red Team Exercises: Regular adversarial testing focused on clinical AI vulnerabilities
- Content Filtering: Multi-stage filtering for harmful or clinically inappropriate outputs
Security Controls Framework
HANA maintains a comprehensive security controls framework across multiple domains:
Access Control & Authorization (30+ Controls)
- Comprehensive access control procedures
- Infrastructure modification restrictions
- Regular access reviews and audits
- Role-based access control with least privilege principles
Data Privacy & Security (60+ Controls)
- Comprehensive data protection procedures
- Anonymization and pseudonymization processes
- Data retention and disposal policies
- Secure data transfer mechanisms
Risk & Incident Management (30+ Controls)
- Incident response procedures
- Risk assessment frameworks
- Vendor risk management
- Business continuity planning
IT & Operational Security (25+ Controls)
- Application monitoring and alerting
- Asset management procedures
- Disaster recovery planning
- Change management processes
EU AI Act Compliance
The European Union’s AI Act classifies AI systems that affect access to healthcare as high-risk applications. This includes AI systems involved in patient triage, clinical decision support, prior authorization, and any scenario where an AI output could influence a patient’s access to care.
Current Status
HANA is actively working toward full EU AI Act compliance for healthcare deployments in Europe:
- Risk classification assessment: Mapping HANA’s capabilities against the AI Act’s high-risk categories to determine registration requirements per use case
- Conformity assessment preparation: Documenting technical architecture, safety measures, and quality management systems required for high-risk AI registration
- EU database registration: Preparing for registration in the EU database of high-risk AI systems as required before production deployment with EU patients
Use Case-Specific Classification
Not all HANA deployments carry the same regulatory classification under the AI Act:
| Use Case | AI Act Classification | Registration Required |
|---|
| Appointment reminders, scheduling | Lower risk | No |
| Pre-operative preparation follow-up | Lower risk | No |
| Clinical screening (PHQ-9, GAD-7) | Potentially high risk | Under assessment |
| Prior authorization / insurance verification | High risk | Yes |
| Clinical decision support influencing care access | High risk | Yes |
What This Means for EU Customers
- Non-high-risk use cases (appointment management, preparation reminders, general outreach) can proceed under standard GDPR compliance
- High-risk use cases (anything involving clinical decisions that affect care access) require HANA to be registered in the EU AI Act database before production deployment — including POC/pilot phases with live patients
- HANA works with EU customers during scoping to classify the intended use case and determine the regulatory pathway
For EU healthcare organizations evaluating HANA: we recommend discussing your intended use case during the scoping phase so we can provide a clear regulatory timeline. Some use cases can proceed immediately; others require registration that we are actively pursuing.
For security inquiries or compliance requests:
- Security Team Email: [email protected]
- Response Time: Standard business hours
- Documentation Access: Available upon request through our trust center
