sycana AI is built for HIPAA-ready referral processing.
We safeguard patient data with defense-in-depth architecture, rigorous compliance, and least-privilege access controls.
Is sycana AI HIPAA-compliant?
sycana AI is HIPAA-ready, not HIPAA-certified — no software vendor is. We sign a BAA before processing PHI, encrypt data at rest and in transit, redact PHI for non-clinical roles, and retain tamper-evident audit logs for seven years. SOC 2-aligned controls are in place and formal certification is in progress. If your review requires a completed SOC 2 Type II or HITRUST report before signing, ask for the current security packet; certification status changes and should be verified for your review date, as of 2026.
HIPAA-Ready
We sign a BAA before any PHI is processed. All PHI is handled in accordance with HIPAA Privacy and Security Rules.
SOC 2-aligned Controls
Built on SOC 2-aligned controls for security, availability, and confidentiality. Formal certification in progress.
Least-Privilege Access
Strict Role-Based Access Control (RBAC), Multi-Factor Authentication (MFA), and least-privilege access policies for all employees.
Infrastructure
Cloud Isolation: sycana AI runs on isolated Virtual Private Clouds (VPC). Patient data databases are not accessible from the public internet.
Encryption: All data is encrypted at rest using AES-256. Data in transit is secured via TLS 1.3. Encryption keys are managed via Cloud KMS.
Resilience: Automated daily backups and multi-zone redundancy ensure High Availability (HA) and rapid disaster recovery.
App Security
Audit Logging: Every action (viewing a record, editing a triage score, or downloading a PDF) is immutably logged for compliance review.
SSO Integration: Enterprise plans support SAML 2.0 / OIDC integration with Okta, Azure AD, and Active Directory.
Penetration Testing: We conduct regular third-party penetration tests and static code analysis to identify and patch vulnerabilities.
AI Safety
Data Privacy: Your PHI is never used to train public models. Retention of inference data depends on your configured vendor policies and BAA terms.
Human-in-the-loop: Our "Glass Box" interface ensures every AI suggestion is verifiable. We provide citations linking back to the source document, reducing hallucination risk and supporting verification in clinical settings.
Need our security packet?
Our team can share our SOC 2-aligned control overview, architecture documentation, penetration test summary, and standard BAA. Certification is in progress.