Aeion Auth for Healthcare
HIPAA-ready identity for systems handling ePHI. AES-256-GCM secret encryption, RFC 4226/6238 TOTP MFA, WebAuthn / FIDO2 hardware keys for clinical workstations (YubiKey, Touch ID), RBAC enforced at the database query layer, immutable audit log with up to 7-year retention. Architecture supports the Security Rule Technical Safeguards (§ 164.312) and Administrative Safeguards (§ 164.308).
What HIPAA Actually Requires
The HIPAA Security Rule's Technical Safeguards (45 CFR § 164.312) and Administrative Safeguards (§ 164.308) impose specific identity-layer requirements:
Clinical Workstation MFA — Hardware Keys
Healthcare deployments typically can't rely on TOTP apps (no phone-on-person policy in patient-facing areas). WebAuthn / FIDO2 hardware keys (YubiKey, Titan, Feitian) are the right pattern — the clinician taps a USB-A key inserted in the workstation; no phone, no SMS, no shared secret.
ePHI Row-Level Access Control
HIPAA's "minimum necessary" rule (§ 164.502) requires that workforce members access only the PHI needed for their role. Aeion enforces this at the database query layer, not the UI route layer: a clinician's access rule can be scoped to only the patients assigned to them, privacy officers and admins can be granted full visibility, and patients themselves can be scoped to only their own record for patient-portal scenarios. Creates, updates, and deletes get their own independent rules — a clinician who can view a record isn't necessarily allowed to edit or delete it.
Encryption Posture
Every credential and identity-relevant secret is encrypted at rest with AES-256-GCM. The encryption context scopes the derivation key per data class — a breach of one table doesn't decrypt others.
Operational Concerns Outside Identity
HIPAA compliance is more than identity. Aeion Auth solves the technical-safeguard authentication layer; you still need:
Healthcare-Specific FAQ
Aeion is a software platform — software doesn't get HIPAA-certified, deployments do. Your covered-entity / business-associate role certifies its own deployment. Aeion's architecture supports the technical safeguards; your operational layer (BAA, training, risk assessment) completes the picture. Aegis compliance reports generate monthly evidence for auditors.
HIPAA requires 6 years of audit log retention for ePHI access events. Aeion's audit log retention defaults to 90 days and is configurable up to 7 years via Aegis compliance retention, included with every deployment. Pair with Aegis's pgBackRest WAL archiving for off-site, immutable backup storage with S3 Object Lock.
Yes — every deployment includes a BAA template and the legal entity supports BAA signing. The BAA between you and Aeion covers the platform service, including dedicated single-tenant infrastructure where applicable; your cloud BAAs (AWS / GCP / Azure) are separate.
Yes — WebAuthn / FIDO2 are widely recognized as strong authenticators that satisfy multi-factor authentication requirements for healthcare workstations. NIST SP 800-63B classifies FIDO2 as AAL3 (highest assurance level).
Configurable per-tenant. Healthcare deployments typically set this to 5min for shared clinical workstations and 30min for personal devices. The setting can be further refined per-role.
Yes — Aeion's per-tenant, per-role architecture supports patient-portal use cases. Set up a dedicated patient role scoped to only their own record. Patient signup typically goes through email + magic link (lower friction than password).