Aligned with the HIPAA Security Rule.

What the rule asks: Procedures to regularly review records of information system activity, such as audit logs, access reports, and security incident tracking reports.

How AxioRank addresses it: Every governed action is written to a retained, tamper-evident log with allow/deny/hold decision counts over the period, giving reviewers a durable activity record.

What the rule asks: Policies and procedures for authorizing access to electronic protected health information, and for granting and modifying that access.

How AxioRank addresses it: Four-level RBAC, scoped and expiring API keys, and deny-by-default row-level isolation govern access; the exported access review lists members, roles, and MFA/SSO.

What the rule asks: A security awareness and training program for all members of the workforce, including periodic security reminders.

How AxioRank addresses it: A workforce control. AxioRank does not train your staff; your organization owns the security awareness program.

What the rule asks: Policies and procedures to address security incidents, including identifying and responding to suspected or known incidents and mitigating their effects.

How AxioRank addresses it: Incidents correlate automatically from governed-call signals, and response rules quarantine agents or revoke keys to mitigate an event as it happens.

What the rule asks: Policies and procedures to limit physical access to electronic information systems and the facilities in which they are housed.

How AxioRank addresses it: A physical facility control satisfied by the SOC 2 Type II audited cloud providers AxioRank runs on; the covered entity relies on their attestations.

What the rule asks: Technical policies and procedures to allow access to ePHI only to persons or software programs that have been granted access rights, including unique user identification.

How AxioRank addresses it: Each human and each agent carries a unique identity; RBAC and scoped, short-lived credentials grant least-privilege access, and every access decision is logged.

What the rule asks: Hardware, software, and procedural mechanisms that record and examine activity in information systems that contain or use ePHI.

How AxioRank addresses it: The gateway records every governed call before returning a decision into an append-only, signed Merkle ledger that an auditor can examine and verify offline.

What the rule asks: Policies, procedures, and mechanisms to protect ePHI from improper alteration or destruction.

How AxioRank addresses it: Hash-chaining and hourly signed tree heads make any alteration, deletion, reordering, or insertion of a record detectable, protecting the integrity of the trail.

What the rule asks: Procedures to verify that a person or entity seeking access to ePHI is the one claimed.

How AxioRank addresses it: SAML SSO and enforced MFA authenticate people; agents authenticate with short-lived, scoped credentials instead of shared static secrets.

What the rule asks: Technical security measures to guard against unauthorized access to ePHI transmitted over an electronic communications network.

How AxioRank addresses it: Data is encrypted in transit; information-flow control and egress allowlists stop ePHI from flowing to untrusted sinks or off-list destinations, with redaction in the log.

What the rule asks: A covered entity must obtain satisfactory assurances, through a written Business Associate Agreement, that a business associate will appropriately safeguard ePHI.

How AxioRank addresses it: A contractual control: a signed BAA with AxioRank is required before ePHI is processed. The BAA itself is executed between the parties, not produced by the platform.

What the rule asks: Maintain the policies, procedures, and required records in written form and retain them for six years from creation or last effective date.

How AxioRank addresses it: Governance configuration is exported as code and the signed integrity proof is designed to outlive purged data; retention is configurable to meet the six-year requirement.