HIPAA-aware by design — stated plainly.
Beacon is designed to support 21 CFR Part 11 / HIPAA expectations for research data handling: minimum-necessary access, auditability, encryption, and documented process. Here is the summary; the Trust Center holds the full detail.
Encryption in transit and at rest
TLS 1.2+ on all endpoints; patient records are encrypted at rest with AES-256-GCM.
Role-based access controls
Distinct roles for patients, physicians, sponsors, coordinators, reviewers, auditors, and administrators — with least-privilege defaults and MFA support for elevated roles.
Hash-chained audit logging
Every record creation, edit, view, export, and access change is timestamped with actor identity, and audit trails travel with the record.
Consent versioning
Each participant’s consent record points to the exact text and date they accepted; amendments preserve history.
Data minimization and retention
Records are kept only as long as the study, regulatory obligation, or participant consent requires.
Breach-response planning
An incident-response runbook with role assignments, notification timelines, and regulator-notification templates.
What “designed to support” means here
We say the platform is designed to support 21 CFR Part 11 / HIPAA workflows. We do not claim certification or formal compliance validation by an auditor — and we will not use those words until they are true. The Trust Center documents what is in place today and what is on the roadmap.
Read the HIPAA noticeSecurity questions before you commit PHI?
Ask us anything about architecture, subprocessors, or BAAs — we would rather answer before the contract than after.