Designed to support HIPAA. Stated without inflation.
This page explains the exact posture: what the platform does to support HIPAA-style data protection, what a BAA covers, and what we deliberately do not claim.
Our posture, precisely
BeaconCR is designed to support HIPAA workflows. That means the platform is built around HIPAA Privacy Rule and Security Rule expectations: minimum-necessary access, role-based permissions, audit logging, encryption at rest and in transit, secure messaging for PHI-bearing communications, and de-identification options for registry-data exports.
It is not a claim of certification. No entity issues “HIPAA certification” — the law itself does not define one — and we do not use the word compliant or certified about our own posture. We describe what is in place and what is on the roadmap, and we update this notice when that changes.
Business Associate Agreements
When BeaconCR processes protected health information on behalf of a covered entity, a Business Associate Agreement is available on request. The standard BAA template covers HIPAA Privacy and Security Rule obligations. Request one through the contact page and we will share what is in place today.
Participant rights
Participants can ask what data a study holds about them and can withdraw at any time; withdrawal is honored through the patient support channel and the responsible physician. See thedata processing pagefor how roles, retention, and rights work in practice.
Covered entity evaluating BeaconCR?
Ask for the BAA and the current security posture summary — both are ready to share.