Security at AlignSure

AlignSure is built to support your HIPAA and HITECH program. Our platform implements administrative, physical, and technical safeguards as required by the HIPAA Security Rule.

All protected health information (PHI) processed through AlignSure is handled in accordance with the HIPAA Privacy Rule.

AlignSure executes Business Associate Agreements (BAAs) with all customers who require them. Our BAA covers all services provided through the AlignSure platform and clearly defines the responsibilities of both parties with respect to PHI.

Before any customer's protected health information reaches a subprocessor, we execute a Business Associate Agreement with that provider. Current status for each provider is listed on our Subprocessors page.

Your team signs in with their Microsoft account through Microsoft Entra ID, using OAuth 2.0 and OpenID Connect. MFA policies configured in your Microsoft tenant are respected. We connect each customer's Microsoft tenant during onboarding, and sign-ins from tenants we haven't connected are refused.

Each customer's data is logically isolated from every other customer's, with separation enforced in the application and the database.

All data in transit is encrypted using TLS 1.2 or higher. All data at rest is encrypted using AES-256 encryption.

AlignSure maintains a documented incident response plan that is tested and updated regularly. Our incident response process includes identification, containment, eradication, recovery, and post-incident review phases.

In the event of a security incident involving PHI, AlignSure will notify affected customers within the timeframes required by HIPAA and applicable state breach notification laws. Notifications include a description of the incident, the types of information involved, and recommended mitigation steps.

SOC 2 is on our roadmap. We'll post a timeline here once an audit is scheduled. In the meantime, we're happy to walk your team through our controls.