Trust & Security

Last updated: August 2026 · This page describes our target/at-launch posture; some attestations are in progress.

Compliance posture

Standard	Status
HIPAA (Security & Privacy Rules)	Aligned by design — Business Associate to our provider partners
SOC 2 Type II	In progress — observation window underway
HITRUST	Roadmap (Year 2)
Business Associate Agreements	Executed with every partner and PHI subprocessor

How we protect data

Encryption in transit: TLS 1.3 with mutual authentication on all imaging and report exchange.
Encryption at rest: AES-256 with customer-managed keys (CMEK) on all PHI stores.
Private networking: PHI traffic stays inside a private cloud perimeter (VPC Service Controls); no public exposure.
Least privilege: role-based access, mandatory MFA, no standing human access to PHI (just-in-time only).
Immutable audit trail: every access to imaging and reports is logged to write-once storage and retained for 7 years.
US data residency: all Medicare-billable final interpretations performed within US territory.

Responsible AI

AI tools used in our workflow are FDA-cleared and strictly assistive. A board-certified radiologist reviews and signs every study; no AI output becomes a final report without physician sign-off. Protected Health Information processed by AI is handled only under Business Associate Agreements and is never used to train third-party models or for advertising.

Report a vulnerability

Security researchers: please email security@radiologyhawk.com. See our security.txt.

This page is informational and does not itself constitute a contract or a warranty. Attestations available under NDA to prospective partners.