HIPAA Compliant
Workflows
HIPAA Assessment 2026-27 (opens in a new tab)Security & Compliance
Last Updated: Aug 20, 2026 | Next Review: Dec, 2026
At Dastify Solutions, protecting your practice’s sensitive healthcare information is our highest priority. We implement industry-leading security measures and maintain rigorous compliance standards to ensure your data remains safe, private, and accessible only to authorized personnel.
BBB
Accredited
256-bit Encryption
Active
HIPAA Compliance
As a Business Associate handling Protected Health Information (PHI), Dastify Solutions maintains full compliance with the Health Insurance Portability and Accountability Act (HIPAA). Our comprehensive HIPAA compliance program addresses all aspects of the Privacy Rule, Security Rule, and Breach Notification Rule.
We execute Business Associate Agreements (BAAs) with all clients and ensure that every member of our team undergoes annual HIPAA training and certification. Our policies and procedures are regularly reviewed and updated to reflect the latest regulatory requirements.
Administrative Safeguards
Security management processes, workforce training, access management, and contingency planning.
Physical Safeguards
Facility access controls, workstation security, and device/media controls for all PHI storage.
Technical Safeguards
Access controls, audit logs, integrity verification, and transmission security for all systems.
Documentation
Policies, procedures, risk assessments, and training records maintained for 6+ years.
Security Measures
Our security infrastructure is designed to protect against unauthorized access, data breaches, and cyber threats. We employ multiple layers of security controls and continuously monitor our systems for potential vulnerabilities.
AES-256 Encryption
All data is encrypted at rest and in transit using Advanced Encryption Standard (AES) 256-bit encryption, the same standard used by financial institutions and government agencies.
Multi-Factor Authentication (MFA)
All user accounts require multi-factor authentication, combining something you know (password) with something you have (authenticator app or hardware key).
Role-Based Access Control (RBAC)
Access to patient data is restricted based on job function and need-to-know basis. We follow the principle of least privilege for all system access.
Security Monitoring & Response
Continuous monitoring of all systems with automated alerts for suspicious activity. Our security operations center responds to potential threats around the clock.
Regular Penetration Testing
Security assessments and testing are performed based on applicable risk, system scope, and security requirements.
Automated Backups & Disaster Recovery
Daily encrypted backups with geographic redundancy. Recovery objectives and procedures are defined based on the applicable systems, services, and continuity requirements.
Regulatory Compliance
Beyond HIPAA, Dastify Solutions maintains compliance with a comprehensive set of healthcare and data protection regulations applicable to medical billing services.
42 CFR Part 2
Enhanced privacy protections for substance use disorder (SUD) patient records in behavioral health billing.
Mental Health Parity Act
For services within our role and contractual scope, applicable privacy and security requirements are addressed through documented processes and client-approved workflows.
CMS Guidelines
Access controls, audit logs, integrity verification, and transmission security for all systems.
State Privacy Laws
Applicable state privacy requirements are addressed based on the client, service, jurisdiction, and contractual scope.
Certifications
Active
HIPAA compliance
Reviewed Annually
Active
BBB
Accredited Business
Q3 2026
HITRUST CSF
Assessment in Progress
Security Stats
Uptime SLA
Service Availability
Security Incidents
Managed
Encryption Level
AES-256
Backup Frequency
Daily
Security Questions?
Our compliance team is available to answer questions about our security practices and provide documentation for your due diligence requirements.
Your Data is Protected
We implement multiple layers of protection to ensure your practice’s data remains secure at every stage—from transmission to storage to access.
Encrypted at Rest
Encryption controls are applied to systems and data within the scope of our security policies and applicable service configurations.
Encrypted in Transit
TLS 1.3 encryption for all data transmission. No unencrypted connections allowed.
Access Controlled
Multi-factor authentication is used for applicable systems and accounts based on access requirements and security policies.
Securely Backed Up
Daily encrypted backups with 30-day retention and geographic redundancy.
Frequently Asked Questions
For questions about our security practices, contact digital@dastifysolutions.com
Do you sign a Business Associate Agreement (BAA)?
Yes, we execute a comprehensive Business Associate Agreement with every client before handling any Protected Health Information. Our BAA covers all HIPAA requirements and clearly defines the responsibilities of both parties regarding PHI protection.
How do you handle data if we terminate services?
Upon termination, we provide a complete export of all your data in standard formats. After confirming successful data transfer, we securely delete all client data from our systems within 60 days, following NIST guidelines for secure data destruction. A certificate of destruction is provided upon request.
What happens if there's a security incident?
We have a documented Incident Response Plan that includes immediate containment, investigation, notification, and remediation procedures. In the unlikely event of a breach involving PHI, we will notify affected clients within 24 hours and work with you to fulfill all HIPAA breach notification requirements.
Where is my data physically stored?
All data is stored in HIPAA-compliant data centers located within the United States. Our infrastructure is hosted on AWS (Amazon Web Services) with primary systems in the US-East region and failover in US-West. Data never leaves the United States.