Written for the person who has to say yes.
This page keeps two lists apart: what is in place today, and what we are adding before any organization's real data is processed. Anything on the first list we can show your security officer. Anything on the second is named as work in progress, not described as done.
Where RAFtimize is today
What is true right now
- RAFtimize runs on synthetic demonstration data. No real participant information has been processed.
- It runs in a single AWS environment in the United States, under a signed business associate agreement with AWS.
- We are completing a defined set of protections — listed on this page — before the first organization's real data is processed.
We would rather tell you this in the first thirty seconds than have you discover it in a questionnaire.
What we are not claiming
- We do not hold a SOC 2 attestation today. No independent party has assessed our controls yet.
- We do not describe ourselves as "HIPAA certified" — no such certification exists, from anyone.
- We will not process an organization's protected health information until a business associate agreement is executed and every item in the readiness gate below is complete.
If a protection is not on the "in place" list, we do not claim it.
The rules we work to
HIPAA Security Rule
45 CFR Part 164, Subpart C. As a business associate, we are directly responsible for the administrative, physical and technical safeguards, the Breach Notification Rule, and the limits our business associate agreements place on how data may be used.
The proposed Security Rule update
HHS proposed a rewrite of the Security Rule in January 2025. It is still a proposal, not final law. We are building to it anyway — multi-factor authentication, encryption, an asset inventory, regular vulnerability scanning, a tested restore and yearly verification — because it describes what a careful customer will ask for.
SOC 2
We are building a SOC 2 program scoped to Security, Availability and Confidentiality, with controls whose evidence goes stale on its own if it is not renewed. An independent readiness review comes first, then a Type I report, then a Type II observation period.
How RAFtimize runs today
A small, deliberate footprint. Your data stays where your clearinghouse already holds it, and RAFtimize reads it there.
| Part | What it is | How it is protected |
|---|---|---|
| The application | The RAFtimize web application, on AWS in the United States. | Reached only over HTTPS with automatically renewed certificates. The server's disk is encrypted. Its data files cannot be read by other accounts on the server. |
| Your encounter data | Held by VisibilEDI, your clearinghouse partner, in its data warehouse. | RAFtimize reads it read-only over an encrypted site-to-site tunnel, and confirms its access is read-only when it connects. |
| Credentials | The data-warehouse sign-in and other secrets. | Held in AWS Secrets Manager and read through a narrowly scoped server role. There are no long-lived AWS access keys anywhere. |
| Submissions to CMS | Encounter submissions. | RAFtimize does not transmit to CMS. Work it identifies goes to VisibilEDI, which submits as it does today. |
Controls we can show you now
Access & identity
- Accounts are created by RAFtimize staff, never self-registered; a one-time setup code reaches the person by phone or in person, never by email
- Passwords of at least 12 characters, stored only as salted PBKDF2-SHA256 hashes with 600,000 iterations
- An account locks after five failed sign-ins; sessions end after 60 minutes idle and 12 hours in total
- Three roles — Admin, Account Manager, customer — with every request held to the user's own organization, checked at the server and again in the application
- When our staff look at a customer's screen, the view is read-only unless an Admin records a reason to act for the customer, for a limited time; either way it is recorded
Data protection
- Encryption in transit: HTTPS to the application, an encrypted tunnel to the data warehouse
- Encryption at rest on the server's disk
- Read-only access to encounter data, confirmed when RAFtimize connects
- Business associate agreement with AWS, our hosting provider
Accountability
- Sign-ins, failed attempts, lockouts, account changes and staff views of customer screens are recorded in an audit log
- Opening a participant's record is recorded with the person and the time; recording of every other participant-level view and export is being added (below)
- Every release passes an automated test suite and a release gate that refuses a build that fails any check
- Documented change control, with a written rollback for every release
Resilience
- A nightly backup with a checksum manifest, read back to confirm it is usable before it is kept
- A restore from backup has been carried out and verified file by file
- The code is held in version control, with every release tagged and recoverable
What we are adding before any organization's real data
This is work in progress, and we name it as such. None of it is claimed above until it is done.
In the application
- Multi-factor authentication for every account, staff and customer
- Every view and export of participant-level data recorded with the person, the organization and the network address, in a log that shows any later change and is copied off the server daily
- The switch to real data locked in software for each organization until the readiness gate below is complete and signed
- Deletion of an organization's data at the end of an engagement, tested before it is needed
In operations
- Backups kept only within AWS, encrypted, in storage that cannot be deleted before its retention ends, plus daily snapshots of the server
- Account-wide activity logging, threat detection and vulnerability scanning in AWS, with a defined patching schedule
- A written HIPAA risk analysis following NIST SP 800-66, reviewed every year
- Written security policies, HIPAA training for everyone with access, and a named Security Official
- An incident response and breach notification plan, rehearsed before it is needed
Planned after that: an independent penetration test, the SOC 2 reports described above, and single sign-on for organizations that want RAFtimize to use their own identity provider.
How "not yet ready for real data" becomes a fact
We are building the move from demonstration data to real data as a control, not a promise: for each organization, the switch stays locked in software until every item below is true and signed.
All must be true before an organization's real data is processed
- A business associate agreement executed for that organization, with the agreements behind it in place
- Multi-factor authentication on for every account that can see the organization's data
- Participant-level access fully recorded, with the record protected and copied off the server
- Backups held only in AWS and encrypted, with a restore tested recently
- A current risk analysis, approved policies, and training completed by everyone with access
- An incident response plan in place and rehearsed
- Deletion of the organization's data tested end to end
- Signed by our Security Official and a second person, with the date recorded
If any item later lapses — an overdue review, an expired training — the gate shows it, and it has to be put right before the switch can be turned on again.
Residency, retention and who else touches it
Where it lives
United States only, within our AWS environment. Our rule: protected health information is never kept on laptops, sent by email, put in file-sharing services, or given to AI tools.
Retention & disposal
Kept for the period your contract and 42 CFR Part 460 require. At the end of an engagement, your data is deleted and we confirm the deletion to you in writing.
Who else touches it
Two parties: AWS, which hosts RAFtimize under a business associate agreement, and VisibilEDI, your clearinghouse, which already holds your encounter data. No one else.
Minimum necessary, by design. RAFtimize reads your encounter data where VisibilEDI already holds it, read-only, instead of asking you to send us copies. Less data movement is both a better security posture and a shorter questionnaire.
What we hand your security team
Under NDA, on request — not after a purchase order.
Control status
Each control on this page, whether it is in place or in progress, and the evidence behind the ones in place.
Data-flow map
Where your data is read, what RAFtimize keeps, and what crosses each boundary.
Business associate agreement
Our draft, for your counsel to mark up.
Readiness gate
The gate for your organization, item by item, so nothing is a surprise at contract time.
Bring your hardest question.
We would rather answer it now than in a redline. Tell us what your security review needs to see and we will send it before the call.