HIPAA Compliance at COALA

Encryption at Rest

All stored data — resident records, staff files, and documents — is encrypted at rest using industry-standard AES-256 encryption.

Encryption in Transit

Every request to and from COALA is secured with TLS/SSL encryption, protecting data as it travels between your device and our servers.

Multi-Factor Authentication

MFA is supported to add an extra layer of protection beyond passwords, reducing the risk of unauthorized account access.

Role-Based Permissions

Granular, role-based access control ensures each user only sees and edits what their role permits — administrators control all permissions.

Access Logging

Platform access events are logged, providing visibility into who accessed what and when.

Automatic Logoff / Session Expiration

Idle sessions automatically expire after a period of inactivity, reducing risk on shared or unattended devices.

Audit Trails

Comprehensive audit trails track key actions across the platform, supporting accountability and regulatory review.

Backups

Data is backed up regularly to support recovery and continuity in the event of an unexpected failure.

Restricted Database Access

Database access is tightly restricted to authorized services and personnel only — no open or public access.

Private S3 File Storage

Uploaded documents and files are stored in private, access-controlled object storage with signed URLs for secure, time-limited access.

Secure APIs

All platform APIs are authenticated, authorized, and encrypted — no unauthenticated or plaintext endpoints.

Least-Privilege Access

Services and personnel operate under least-privilege principles, meaning access is limited to the minimum required to perform a task.

Production / Dev Separation

Production and development environments are fully separated, preventing untested or unreviewed code from touching live user data.