Data Security & Privacy - Hamly Business Solutions

Data Security
& Privacy.

We handle Protected Health Information (PHI) with rigorous security controls, operating in full compliance with HIPAA Security Rule requirements under 45 CFR §164 — ensuring every layer of our infrastructure meets federal data protection standards.

shield_locked HBS SECURE CORE

SYSTEM ACTIVE

gpp_good

BSI ISO 27001:2022 Certified

enhanced_encryption

AES-256 Encryption at Rest

security

NGFW Enterprise-grade Firewall

monitoring

24/7 Real-time SIEM Monitoring

HIPAA Security Rule
Compliance

We operate in full compliance with HIPAA Security Rule requirements under 45 CFR §164, maintaining robust administrative, physical, and technical safeguards.

Confidentiality & Availability

45 CFR §164.306

We deploy administrative, physical, and technical safeguards to ensure all ePHI remains confidential, maintains integrity, and is reliably accessible.

Threat Identification

45 CFR §164.308(a)(1)

Ongoing risk analyses identify and evaluate vulnerabilities across all system components. Remediation plans are updated upon system changes.

Disclosure Controls

45 CFR §164.502

Technical and policy controls prevent the use or disclosure of ePHI outside permitted purposes. Automated alerts flag anomalous patterns.

Workforce Compliance

45 CFR §164.308(a)(3)

Workforce members receive mandatory HIPAA awareness training. Documented sanction procedures are enforced for any policy violations.

Workstation Security

Every workstation that handles PHI is rigorously secured through layered controls and strict access policies.

Restricted personnel access — least
privilege principle

Full-disk encryption with strong password
policies

Limited authorized usage — no personal
software

Automatic screen lock and session timeout
controls

Managed software inventory and patch
management

Incident Management

All security incidents involving PHI are reported immediately through a structured escalation process. A dedicated incident response plan defines containment, investigation, and corrective action steps. All workforce members are trained on incident identification and mandatory reporting timelines aligned with HIPAA Breach Notification Rule requirements under 45 CFR §164.400.

Security Audits

We conduct annual third-party security audits to validate compliance with HIPAA Security Rule and ISO 27001:2022 controls. Internal reviews are performed quarterly, covering access logs, system activity, and policy adherence. Findings are documented, tracked to resolution, and reviewed by leadership to drive continuous improvement.

Remote Access Policies

All remote access to PHI environments is permitted exclusively through secured, encrypted VPN tunnels. Multi-Factor Authentication (MFA) is mandatory for every remote session. Sessions are time-limited, fully logged, and subject to periodic access reviews. Personal devices are prohibited from accessing PHI without formal authorization and device compliance verification.

Encrypted Communications

All communications containing PHI — whether internal team communications or external transmissions to clients and providers — are conducted exclusively over encrypted channels using TLS 1.2. Unencrypted transmission of PHI via standard email, messaging apps, or any unapproved channel is strictly prohibited under our Acceptable Use Policy.

Fortified Data Security

Our defense-in-depth architecture ensures PHI is protected at every layer — from the network edge to the application level.

ISO 27001:2022 — BSI Certified

We hold active ISO 27001:2022 certification, independently awarded by BSI Group — one of the world’s foremost accreditation bodies. This internationally recognized standard confirms that our organization systematically identifies security risks, implements verified controls, and undergoes rigorous annual third-party audits. For our clients, this means every process touching your data is governed by a certified, auditable security framework — not just internal policy.

ISO 27001

Status: Active

Firewall & Network Security

Enterprise-grade next-generation firewall (NGFW) protects our network perimeter with deep packet inspection and intrusion prevention. Internal environments are segmented using VLAN architecture, ensuring PHI systems are fully isolated from general traffic.

Next-Gen Firewall

Automated Patching

Deep Packet Inspection

Intrusion Prevention

Encryption Standards

Data at rest is encrypted using AES-256 across on-premises systems and cloud-based file storage. All data in transit is secured using TLS 1.2 across all internal and external communication channels.

AES-256 at Rest

TLS 1.2 in Transit

Cloud Storage Encrypted

SIEM & Threat Monitoring

A dedicated Security Information and Event Management (SIEM) platform provides 24/7 real-time threat detection, centralized log aggregation, behavioral anomaly detection, and automated incident response across our entire infrastructure.

24/7 SIEM Monitoring

TLS 1.2 in Transit

Automated Response

Endpoint & Vulnerability Management.

Unified endpoint management ensures automated patch deployment, software control, and continuous vulnerability scanning across all workstations and devices that handle PHI. Non-compliant endpoints are automatically flagged and remediated.

Unified Endpoint Mgmt

Automated Patching

Continuous Vuln Scanning

Identity & Access Management

Multi-Factor Authentication (MFA) is enforced across all systems. Role-based access controls (RBAC) ensure minimum necessary access to PHI, aligned with HIPAA’s minimum necessary standard.

MFA Enforced

RBAC

Least Privilege

Cloud & Hybrid Infrastructure

Operations are hosted on HIPAA-eligible services from Google Cloud, supplemented by secure on-premises systems. Our hybrid infrastructure controls are independently validated through annual third-party audits.

Google Cloud

On-Premises

Annual Audit

Additional Safeguards

Beyond technical infrastructure, our operational policies and administrative controls provide comprehensive protection across every touchpoint where PHI is accessed or processed.

Remote Access Policies

PHI environments are accessible remotely only through secured, encrypted VPN connections with MFA enforced at every login. Remote sessions are time-limited, fully audit-logged, and reviewed periodically. Unauthorized devices are blocked from accessing any PHI system.

Software & Device Controls

Only approved, licensed software is permitted on PHI-handling workstations. An active software inventory is maintained and enforced through centralized endpoint management. Unauthorized installations are automatically detected and blocked before they can pose a risk.

Encrypted Communications

Every transmission of PHI — internal or external — is conducted over encrypted channels (TLS 1.2). Standard email and consumer messaging applications are prohibited for PHI exchange. All client and provider communications follow our documented Secure Communication Policy.

Data Retention & Disposal

PHI is retained only for the duration required by applicable federal and state regulations. Secure data disposal procedures — including certified digital wiping and physical media destruction — are applied when PHI is no longer needed, preventing unauthorized recovery.

Physical Security Controls

Access to facilities housing PHI systems is restricted through badge-based entry controls and visitor management protocols. Server rooms and workstation areas are monitored, and physical access logs are maintained and reviewed regularly to prevent unauthorized entry.

Backup & Disaster Recovery

Critical PHI data is backed up regularly using encrypted backups stored in geographically separate, secured environments across our hybrid cloud infrastructure. Disaster recovery procedures are documented and tested periodically to ensure business continuity and rapid restoration of PHI availability.