Statement of HIPAA Compliance

This attestation applies to the Ultradoc platform, including the staff web application, the Ultradoc patient application for iOS and Android together with its update-delivery service, and all API interfaces operated under the ultradoc.net domain, together with the underlying services, databases, and supporting infrastructure that store or process Protected Health Information on behalf of Ultradoc's customers.

The controls described herein apply to all workforce members of Ultradoc and to all subcontractors engaged by Ultradoc that create, receive, maintain, or transmit PHI on Ultradoc's behalf.

All defined terms used in this instrument have the meanings ascribed to them in the HIPAA Rules. Selected terms are summarized below for the convenience of the reader.

a. Covered Entity.

A health plan, health care clearinghouse, or health care provider who transmits health information in electronic form in connection with a covered transaction, as defined at 45 CFR § 160.103.

b. Business Associate.

A person or entity that performs functions or activities involving the use or disclosure of Protected Health Information on behalf of, or provides services to, a Covered Entity. Ultradoc is a Business Associate to its customers.

c. Protected Health Information (PHI).

Individually identifiable health information transmitted or maintained in any form or medium, as defined at 45 CFR § 160.103. References herein to PHI include electronic PHI (ePHI).

d. Subcontractor / Subprocessor.

A person or entity to whom a Business Associate delegates a function, activity, or service, and who creates, receives, maintains, or transmits PHI on behalf of the Business Associate.

e. Workforce.

Employees, contractors, and other persons whose conduct, in the performance of work for Ultradoc, is under the direct control of Ultradoc, whether or not they are paid by Ultradoc.

f. Security Incident.

The attempted or successful unauthorized access, use, disclosure, modification, or destruction of information, or interference with system operations in an information system, as defined at 45 CFR § 164.304.

§ 3.01 Designated Security & Privacy Officer.

Ultradoc designates a named Security Officer and Privacy Officer responsible for the development, implementation, and ongoing maintenance of policies and procedures required by the HIPAA Security and Privacy Rules.

§ 3.02 Workforce training & awareness.

All workforce members with access to PHI complete HIPAA training at onboarding and on a recurring annual basis. Training covers the Security Rule, the Privacy Rule, breach notification, sanctions, password management, and incident reporting. Training records are retained for a minimum of six (6) years.

§ 3.03 Workforce clearance & termination.

Access to systems containing PHI is provisioned only after a documented clearance procedure. Upon separation, role change, or loss of authorization, all access is revoked without delay in accordance with a documented termination procedure.

§ 3.04 Risk analysis & risk management.

Ultradoc conducts formal, documented risk analyses of the confidentiality, integrity, and availability of ePHI in accordance with 45 CFR § 164.308(a)(1)(ii)(A). Identified risks are tracked in a risk register and remediated pursuant to a documented risk-management program under § 164.308(a)(1)(ii)(B). The risk analysis is reviewed at least annually and within thirty (30) days of any of the following: a new customer-facing application surface, a new subprocessor that receives PHI, a new authentication path, or a security assessment with a High-severity finding.

§ 3.05 Information system activity review.

Ultradoc implements procedures to regularly review records of information system activity, including audit logs, access reports, and security-incident tracking reports, as required by 45 CFR § 164.308(a)(1)(ii)(D).

§ 3.06 Sanction policy.

Ultradoc maintains and enforces a formal sanction policy against workforce members who fail to comply with its security policies and procedures, pursuant to 45 CFR § 164.308(a)(1)(ii)(C).

§ 3.07 Contingency planning.

Data backup, disaster recovery, and emergency-mode operation plans are documented, maintained, and tested periodically to ensure continued availability of PHI during adverse events, in accordance with 45 CFR § 164.308(a)(7). Production data is backed up daily by the database provider under its Business Associate Agreement, and restoration procedures are documented.

§ 3.08 Evaluation.

Ultradoc performs periodic technical and nontechnical evaluations of its security controls, in response to environmental or operational changes affecting the security of ePHI, as required by 45 CFR § 164.308(a)(8).

§ 4.01 Cloud-hosted infrastructure.

Ultradoc operates no on-premise data centers. All production systems run on SOC 2 Type II audited cloud infrastructure operated by HIPAA-eligible providers, governed by executed Business Associate Agreements.

§ 4.02 Facility access controls.

Physical access to the facilities housing production infrastructure is controlled, monitored, and logged by the underlying cloud providers in accordance with their published compliance programs (SOC 2 Type II, ISO 27001, FedRAMP).

§ 4.03 Workstation security.

Workforce devices authorized to access PHI are subject to full-disk encryption and automatic screen-lock. A managed device baseline (centralized patch management, endpoint detection and response, and mobile device management with remote-wipe capability) activates upon workforce expansion.

§ 4.04 Device & media controls.

Removable media are prohibited for storage of PHI. All media potentially containing ePHI are sanitized or destroyed in accordance with NIST SP 800-88 Rev. 1 guidelines prior to reuse or disposal.

§ 4.05 Patient-owned devices.

The Ultradoc patient application runs on devices that patients own and Ultradoc does not manage. The application keeps its session credential and any cached PHI in the operating system's hardware-backed keystore, offers a biometric lock, masks its content in the application switcher, and honors remote session revocation and account deactivation.

§ 5.01 Unique user identification.

Every workforce member and end user is assigned a unique account. Shared or group credentials are prohibited for access to PHI.

§ 5.02 Person & entity authentication.

Authentication is enforced at every entry point to systems containing PHI. Multi-factor authentication is required for all Ultradoc platform administrators, is available to every end user, and may be required by tenant administrators for any role as part of their organization's access-control policy.

§ 5.03 Automatic logoff.

Idle sessions are terminated after a defined period of inactivity. Re-authentication is required to resume access.

§ 5.04 Integrity controls.

Mechanisms are in place to ensure PHI is not improperly altered or destroyed. Integrity is validated through cryptographic checksums, versioning, and referential database constraints.

§ 5.05 Transmission security.

Network traffic carrying PHI is protected in transit as described in Article VI (Encryption), which also states the one deliberate exception, the patient text message program. Inbound machine-to-machine messages from integrated services are accepted only after cryptographic signature verification, and outbound connections to configured endpoints are validated against private and loopback address ranges before any request is made.

§ 5.06 Malicious software protection.

Workstations run host-based protection appropriate to current workforce size. Centralized endpoint protection with managed reporting activates upon workforce expansion.

Ultradoc executes a Business Associate Agreement with every covered entity that uses the platform to create, receive, maintain, or transmit Protected Health Information. Ultradoc's standard BAA obligates Ultradoc to use and disclose PHI only as permitted by the Agreement and the HIPAA Rules, to implement the safeguards required by the Security Rule, and to report impermissible uses, disclosures, and security incidents promptly.

Ultradoc further maintains a Business Associate Agreement with every subcontractor that creates, receives, maintains, or transmits PHI on Ultradoc's behalf. No subcontractor is granted access to PHI without a fully executed BAA on file. Each subcontractor BAA flows down the material obligations of the HIPAA Rules, including encryption, access-control, audit, breach-notification, and return-or-destruction obligations.

Certain services are engineered so that no Protected Health Information reaches them, and those services fall outside the scope of subcontractor Business Associate Agreements: transactional email, which carries only account-security messages such as verification codes, invitations, and password resets; public place search, which receives only a pharmacy or address as spoken by a caller, with no patient identifier; and push notifications, whose text is drawn from a fixed set of sentences and whose payload carries only record identifiers. The absence of PHI on those channels is an engineering control maintained under Ultradoc's code-review standards.

A current list of Ultradoc subprocessors that process Protected Health Information is available to covered-entity customers upon request, subject to a mutual confidentiality agreement. Requests may be directed to compliance@ultradoc.net.

Access to Protected Health Information is governed by a formal role-based access control (RBAC) model. Authorization is evaluated at the application layer on every request, and no user or service is granted access to PHI outside the bounds of an assigned role.

§ 8.01 Role-based authorization.

Every workforce member and end user is assigned one or more roles that define the scope of data they may access and the actions they may perform. Authorization decisions are enforced at the application layer on every request.

§ 8.02 Least-privilege principle.

The Ultradoc platform supports enforcement of the least-privilege principle by permitting tenant administrators to scope role assignments to the minimum access necessary to perform assigned job functions, consistent with the Minimum Necessary Standard at 45 CFR § 164.502(b).

§ 8.03 Separation of duties.

Administrative and production-data access are held by distinct roles. No single role combines authority to modify access-control configuration and authority to access PHI at scale.

§ 8.04 Periodic access review.

Role assignments and privileged-access grants are reviewed on a recurring basis. Stale, unused, or inappropriate access is revoked as part of each review cycle.

§ 8.05 Privileged access management.

Administrative access to production systems requires multi-factor authentication, is time-scoped where feasible, and is subject to enhanced audit logging and monitoring.

Ultradoc records and retains a tamper-resistant, append-only audit trail of activity on systems that contain Protected Health Information. Audit records are designed to support incident investigation, regulatory inquiry, and ongoing security operations.

1. (a)Every create, update, and delete of a record containing PHI, and every read of PHI, is recorded to a tamper-resistant, append-only audit log. In-progress editor drafts are retained transiently on the server and are not individually journaled; the record they produce is journaled when it is filed, and reads of a draft are recorded as reads of PHI.
2. (b)Every authentication event, session-start, session-termination, and access-control change is recorded.
3. (c)Audit records include the actor, the action, the affected resource, the timestamp, and the source context.
4. (d)Audit logs are retained for a minimum of six (6) years in accordance with 45 CFR § 164.316(b).
5. (e)No workforce-facing interface to modify or delete audit log entries is exposed. Repeated identical events within a short window are coalesced to mitigate log-flooding.
6. (f)Logs are reviewed on a recurring basis by the Security Officer or designee.

Audit records pertaining to a covered entity's use of the Ultradoc platform are preserved for the full six (6) year retention period, including following the termination of the business relationship between Ultradoc and the covered entity. Former customers may, at any time during the retention period, contact compliance@ultradoc.net to request audit information or supporting documentation relating to their prior use of the platform.

Ultradoc maintains documented emergency-access procedures for the continuity of clinical operations during periods in which the Ultradoc platform is unavailable or emergency conditions require immediate access to Protected Health Information. Because Ultradoc operates as a workflow overlay on the covered entity's EHR, the covered entity's EHR remains the operative channel for emergency clinical access.

§ 10.01 Primacy of the EHR of record.

Ultradoc operates as a workflow overlay on the covered entity's EHR. The EHR of record remains the authoritative source for Protected Health Information and governs emergency access to patient data under its own emergency-access procedures.

§ 10.02 Fallback in the event of unavailability.

In the event the Ultradoc platform is unavailable, clinical workforce members are directed to continue operations through the covered entity's EHR pursuant to the covered entity's own emergency-access policies. No PHI is required to be retrieved from Ultradoc in order to deliver care.

§ 10.03 Post-event review by Ultradoc.

If unavailability of the Ultradoc platform materially contributes to an emergency condition affecting a covered entity, Ultradoc conducts an internal root-cause review and reports findings to the affected covered entity.

§ 10.04 Patient-facing channels.

The patient application, secure messaging, scheduling requests, and the telephony assistant are conveniences layered over the covered entity's established channels. During an Ultradoc outage, patients are directed to the practice's telephone line and the practice's own scheduling process, and practices are asked to configure the telephony assistant's number to fail over to a human-answered line.

Ultradoc maintains a documented Security Incident Response program that defines responsibilities, escalation paths, and the steps by which suspected and confirmed security incidents are addressed. The program is aligned with the phases outlined in NIST SP 800-61 Rev. 2 and the incident-response requirements of 45 CFR § 164.308(a)(6).

1. 01

   Detection.

   Continuous monitoring and workforce reporting channels are used to identify potential security incidents.

2. 02

   Triage.

   The Security Officer or designee classifies each reported event by severity and scope, and determines whether it constitutes a Security Incident or a potential Breach of Unsecured PHI.

3. 03

   Containment.

   Immediate steps are taken to isolate affected systems, revoke compromised credentials, and prevent further unauthorized access.

4. 04

   Eradication.

   The root cause is identified and remediated; affected systems are restored from known-good state.

5. 05

   Recovery.

   Normal operations are resumed under heightened monitoring until stability is confirmed.

6. 06

   Post-incident review.

   A documented after-action review captures findings, identifies systemic improvements, and updates policies, controls, or training as warranted.

In the event Ultradoc discovers a breach of unsecured Protected Health Information, Ultradoc will notify the affected covered entity without unreasonable delay and in no case later than sixty (60) calendar days following discovery, in accordance with 45 CFR § 164.410.

The notification will include, to the extent known at the time of notification and supplemented thereafter as additional information becomes available: the identification of each individual whose unsecured PHI has been, or is reasonably believed to have been, accessed, acquired, used, or disclosed; a description of the nature of the breach; the types of PHI involved; and the steps Ultradoc has taken and is taking to mitigate, investigate, and prevent recurrence.

Workforce members are trained to recognize suspected breaches and to report them immediately to the Security Officer. The Security Officer is responsible for coordinating Ultradoc's response, including forensic investigation, risk assessment under § 164.402, and any required notifications.

As a Business Associate, Ultradoc supports its covered-entity customers in honoring the rights granted to individuals under the Privacy Rule. Upon a covered entity's request, Ultradoc will provide, amend, restrict, or account for an individual's PHI as necessary to permit the covered entity to fulfill its obligations, including:

1. (i)Right of access to and a copy of PHI maintained in a designated record set.§ 164.524
2. (ii)Right to request amendment of inaccurate or incomplete PHI.§ 164.526
3. (iii)Right to an accounting of disclosures of PHI.§ 164.528
4. (iv)Right to request restrictions on certain uses and disclosures.§ 164.522
5. (v)Right to request confidential communications by alternative means or at alternative locations.§ 164.522
6. (vi)Right to receive notice of a breach of unsecured PHI.§ 164.404
7. (vii)Right to file a complaint without retaliation.§ 164.530(g)

§ 14.01 Retention of PHI.

PHI is retained by Ultradoc only for so long as required to deliver the service, to comply with the governing Business Associate Agreement, or as otherwise required by applicable law.

§ 14.02 Return or destruction upon termination.

Upon termination of a Business Associate Agreement, Ultradoc will, as directed by the Covered Entity, return or destroy all PHI received from, or created or received on behalf of, the Covered Entity, in accordance with 45 CFR § 164.504(e)(2)(ii)(J).

§ 14.03 Retention of compliance documentation.

Policies, procedures, audit logs, training records, risk analyses, and other HIPAA-related documentation are retained for a minimum of six (6) years from the date of creation or the date when last in effect, whichever is later, pursuant to 45 CFR § 164.316(b)(2)(i).

§ 14.04 Secure destruction.

Destruction of PHI, whether in electronic or physical form, is performed in accordance with NIST SP 800-88 Rev. 1 such that the information is rendered unreadable, indecipherable, and otherwise cannot be reconstructed.

Ultradoc treats HIPAA compliance as a continuous program rather than a one-time exercise. Policies and procedures are reviewed at minimum annually, and whenever a material change in operations, technology, or applicable law warrants an earlier review. Ultradoc's most recent Security Risk Analysis was completed on September 8, 2026.

Ultradoc's security program is designed to align with recognized industry frameworks, including NIST SP 800-66 Rev. 2 (HIPAA Security Rule Implementation Guide), NIST SP 800-53 Rev. 5, the HHS Office for Civil Rights guidance on HIPAA Security, and applicable provisions of SOC 2. Internal reviews and, where appropriate, independent external assessments of the control environment are conducted on a periodic basis.

Questions, complaints, or requests related to this attestation, Ultradoc's privacy practices, or the handling of Protected Health Information may be directed to the addresses of record set forth below.

Individuals retain the right to file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, if they believe their rights under the HIPAA Privacy Rule have been violated. Filing instructions are available at hhs.gov/ocr/complaints.

Ultradoc welcomes reports of security vulnerabilities from researchers, customers, and members of the public. If you believe you have discovered a vulnerability affecting the Ultradoc platform, please report it to the Office of Security and Ultradoc will engage with you in good faith toward resolution.

Ultradoc asks that reporters allow a reasonable period to investigate and remediate before any public disclosure, and that reporters make every reasonable effort to avoid privacy violations, service degradation, and any interaction with Protected Health Information.

Researchers who comply with this policy will not be subject to civil or criminal action by Ultradoc for their research activities. This policy does not authorize action that is inconsistent with applicable law, and nothing in this policy should be read to authorize any violation of the Computer Fraud and Abuse Act, state computer-crime statutes, or any law of a foreign jurisdiction.