Skip to content
FlashTowerFlashTower home

Healthcare

Designed to support HIPAA-regulated environments.

Healthcare organizations use AI tools that can touch protected health information. FlashTower helps you see and control them, with safeguards built for regulated data.

Business Associate Agreement

FlashTower does not sign BAAs yet.

Do not upload protected health information

Until FlashTower signs a Business Associate Agreement with your organization, do not upload protected health information to FlashTower. You can still use FlashTower to inventory AI tools and assess their risk using descriptions and metadata, which do not require PHI. To be told when BAAs become available, contact security@flashtower.com.

Read the terms FlashTower uses: Business Associate Agreement. It covers permitted uses, safeguards, subcontractors, breach notification, individual rights, and return or destruction of PHI at termination.

Safeguards

How FlashTower protects regulated data

Mapped to the HIPAA Security Rule's administrative, physical, and technical safeguards in our internal program.

Access control

Organization data is isolated by Postgres row-level security on every query. Six roles, checked on the server and mirrored in the database. Two-factor sessions are enforced in the database for every account that enrolled a second factor.

Audit controls

Security-relevant actions are written to an append-only audit log; database triggers block edits and deletes, so entries cannot be edited or deleted through the application. Entries are kept for at least one year, then removed under the retention schedule (or when the organization is deleted). FlashTower staff access to the administration console requires MFA and is itself audited.

Integrity and transmission security

TLS with HSTS for all traffic. Approvals for response actions are bound to the approving user's own session. Exports and evidence packages carry integrity hashes.

Encryption

Data is encrypted at rest by our infrastructure providers. Connector credentials and preserved evidence are additionally encrypted by the application with AES-256-GCM, bound to the organization.

Minimum necessary

FlashTower is built to work with metadata about AI tools, agents, and systems rather than the records those systems hold. Agent Security redacts the sensitive values its pattern-based detectors recognize before storage, and error reports and analytics are scrubbed of personal data.

Breach notification

A documented incident response and breach workflow, with a contractual notice commitment in the Business Associate Agreement and our security incident terms.

Where PHI could appear, and how it is handled

  • Agent Security events (Agent Gateway, DLP, Egress): sensitive values that the pattern-based detectors recognize are redacted before storage (detection cannot catch every disguised value); raw content is kept only in the Threat Evidence Vault when your organization turns capture on.
  • Threat Evidence Vault: off by default, encrypted by the application, access-logged, with retention and legal hold you control.
  • Reports and exports: generated from your organization's data on request and downloaded over TLS by authorized roles only.
  • Support tickets: do not include PHI in tickets or attachments; describe the issue instead.
  • Error monitoring, analytics, and email: never receive PHI by design; personal data is scrubbed before error reports and analytics.
  • Optional AI explanations: off by default; only when your organization enables AI explanations, the AI provider receives finding titles and explanations and your AI system names, redacted.

Your responsibilities

  • Sign a BAA with FlashTower before any PHI reaches the Service, and keep PHI to the features it covers.
  • Enable two-factor authentication for every member and assign the least-privileged role.
  • Configure retention and evidence capture to match your policies.
  • Approve Guard response actions deliberately; FlashTower never changes your systems without your approval or an automation policy your owners or admins authorized.
  • Remain responsible for your own HIPAA compliance program.

FlashTower is not HIPAA certified, and no government agency or industry body certifies HIPAA compliance. FlashTower has not completed an independent HIPAA assessment, a SOC 2 audit, or an independent penetration test; current status is on the Trust Center. Using FlashTower does not by itself make an organization HIPAA compliant.