Overview
How we handle your patients' data.
Unisona Health stores protected health information for behavioral health and substance use treatment organizations. That means two overlapping regimes — HIPAA, and the stricter confidentiality rules for substance use records under 42 CFR Part 2 — and both are built into the product rather than written into a policy nobody reads.
This page is where we publish what is true today. Where a control is complete, it says so. Where an audit is underway, it says that instead. We would rather lose a deal to a vendor with a finished SOC 2 report than claim one we do not have.
Compliance
Compliance
Frameworks we are held to, and where each one currently stands.
One we are not: Unisona Health is not ONC Health IT certified, and does not claim to be. If your funding or contracts require certified EHR technology, say so early in an evaluation.
Administrative, physical, and technical safeguards implemented. BAA executed before any PHI is loaded.
Consent-scoped disclosure controls for substance use disorder records, enforced at the record level.
Breach notification procedures and timelines documented and tested.
Audit engaged. The report is not yet available and we will publish it here when it is.
Third-party application testing scheduled. Results will be published as a summary report.
Under evaluation. We will not claim it until certification is complete.
Documents
Documents
Public documents are available on this site. Private documents are released under a mutual NDA, usually within one business day.
Product security
Product security
Security controls your administrators operate themselves, inside the product.
Immutable activity log of every view, edit, signature, export, and permission change, retained seven years.
Permissions scoped by role, program, billing entity, and record section.
SAML SSO for organizations that require it.
Multi-factor authentication is [confirm: mandatory for all users / available on all accounts and enforceable at the organization level].
Configurable idle timeout and forced re-authentication for sensitive actions.
Customers can export their records in a usable format at any time, including at termination.
Data security
Data security
How records are protected while we hold them, and what happens when you leave.
TLS 1.2 or higher on all connections. HSTS enabled.
AES-256 on all stored data, including backups and file attachments.
Each customer's records are logically separated and scoped to their tenant.
Encrypted automated backups with point-in-time recovery. Restores are tested.
Retention configurable to your state and accreditation requirements.
Documented deletion process on termination, with written confirmation.
Access control
Access control
Who at Unisona Health can reach production data, and under what conditions.
Internal access to production is limited to the smallest set of staff required.
Multi-factor authentication is mandatory for Unisona Health staff accessing production systems.
Internal access is reviewed on a scheduled basis and on every role change.
Access revoked as part of the documented departure checklist.
Administrators can produce a report of who can see what, for their own reviews.
Data privacy
Data privacy
Obligations specific to behavioral health records, including the ones HIPAA alone does not cover.
Executed with every covered entity before implementation begins.
Named recipient, purpose, scope, and expiration captured and enforced on disclosure.
Documented process and timelines consistent with HIPAA and HITECH.
Process for access, correction, and accounting-of-disclosures requests.
We do not sell, rent, or share customer data. Identifiable patient data is never used to train models. Any model training uses data de-identified under HIPAA standards.
Privacy questions and requests are handled by a named contact, not a queue.
Infrastructure
Infrastructure
Where the platform runs and how it is monitored.
United States regions only. Data does not leave the country without your written instruction.
Continuous uptime and performance monitoring with alerting.
Public status and incident history.
Production runs in a private network with restricted ingress.
Edge protection and rate limiting in front of the application.
Centralized infrastructure logs with automated alerting on anomalies.
Application security
Application security
How the software itself is built, reviewed, and released.
Peer review required on every change. No direct writes to production.
Automated scanning of third-party libraries with tracked remediation.
Report a vulnerability to security@unisonahealth.com. We respond and will not pursue good-faith researchers.
Documented release process with rollback, tested before production.
Corporate security
Corporate security
The controls that apply to our own team.
Performed on staff with access to production systems, where permitted by law.
Required at onboarding and annually, with completion recorded.
Company devices are encrypted, managed, and remotely wipeable.
Signed by every employee and contractor before access is granted.
Subprocessors
Subprocessors
Third parties that may process customer data, what each one does, and whether it receives protected health information. This is the same list published on our HIPAA compliance page, which our Business Associate Agreement incorporates by reference. We post a notice on this page before adding any subprocessor that touches protected health information.
Policies
Policies
Written policies maintained by Unisona Health. Full text is available under NDA.
Reviewed annually and on material change.
Reviewed annually and on material change.
Reviewed annually and on material change.
Reviewed annually and on material change.
Reviewed annually and on material change.
Reviewed annually and on material change.
Reviewed annually and on material change.
Reviewed annually and on material change.
Reviewed annually and on material change.
Reviewed annually and on material change.
Reviewed annually and on material change.
Reviewed annually and on material change.
Incident response
Incident response
What happens if something goes wrong, and how to tell us if you find something. Report a suspected security incident to security@unisonahealth.com.
Documented plan with defined roles, severity levels, and communication steps.
Affected customers are contacted directly, within the timelines HIPAA requires.
Every incident gets a written review, and material ones are posted to this page.
Send findings to security@unisonahealth.com. We will acknowledge within two business days.
Business continuity
Business continuity
What happens if infrastructure fails, and how quickly you get back to a working chart.
Documented recovery objectives with restores tested on a schedule.
Backups are encrypted, access-controlled, and stored separately from production.
Multi-zone deployment so a single failure does not take the platform down.
Scheduled continuity exercises with documented outcomes.
Trust Center updates
Trust Center updates
Changes to our security posture, subprocessors, and compliance status, most recent first.
Subprocessor list consolidated
The Trust Center and the HIPAA compliance page now publish the same subprocessor list, from a single source. The HIPAA page previously listed only our database and hosting providers. Each entry now shows whether the vendor receives protected health information, whether a business associate agreement is in place, and where it processes data. Twilio now covers Programmable Video for telehealth as well as SMS, and the list adds the AI vendor behind dictation and writing assistance. This is the list our Business Associate Agreement incorporates by reference.
Trust Center published
This Trust Center replaces the ad-hoc security questionnaire process. Public documents are downloadable immediately; private documents are available under NDA.
SOC 2 Type II audit engaged
We have engaged an independent auditor for a SOC 2 Type II examination. We will publish the report here when the observation period closes. Until then we do not represent ourselves as SOC 2 certified.
Subprocessor list published
Our current subprocessors and the purpose of each are now listed on this page. We will post a notice here before adding any subprocessor that processes protected health information.
Questions
Security and compliance questions
Is Unisona Health HIPAA compliant?
Yes. Administrative, physical and technical safeguards are implemented, and a Business Associate Agreement is executed with every covered entity before any PHI is loaded. Breach notification procedures and timelines are documented and tested under HITECH.
Does Unisona Health sign a BAA?
Yes. A Business Associate Agreement is executed with every covered entity before implementation begins, and a template is available from the Trust Center documents list.
Does Unisona Health support 42 CFR Part 2?
Yes. Substance use disorder records get consent-scoped disclosure controls enforced at the record level, so every disclosure ties back to the consent that permitted it.
Is Unisona Health SOC 2 certified?
Not yet. An independent auditor is engaged for a SOC 2 Type II examination, and the report will be published on the Trust Center when the observation period closes. Until then Unisona Health does not represent itself as SOC 2 certified.
Is Unisona Health ONC certified?
No. Unisona Health is not ONC Health IT certified and does not claim to be. Certification matters most where a program must use certified EHR technology for a federal incentive or reporting requirement, so if your funding or payer contracts require CEHRT, raise it early in an evaluation. Data portability is handled directly instead: API and FHIR access, and a full export of your records at any time.
How is patient data encrypted and where is it hosted?
Data is encrypted in transit with TLS 1.2 or higher and at rest with AES-256, including backups and file attachments. It is hosted in United States regions only and does not leave the country without your written instruction.
How long is the audit log kept?
Every view, edit, signature, export and permission change is written to an immutable activity log retained for seven years.
Security reviews and questionnaires go to Hello@unisonahealth.com, and BAA requests to legal@unisonahealth.com. Both are answered by a person, not a portal.
Report it to security@unisonahealth.com. We acknowledge within two business days and will not pursue good-faith research.