Data Security and Privacy
Roji Health Intelligence ensures robust security and data privacy throughout Roji Health Intelligence hardware and software.
Does Roji Health Intelligence meet HIPAA Security and Privacy standards in allowing access to the Registry?
Yes, we meet or exceed all HIPAA and HITECH requirements. Access to the Roji Registry requires individual authentication and is role-based.
How does Roji Health Intelligence physically secure the data?
Roji Health Intelligence is currently transitioning storage of data from a physical ultra-secure facility to an Amazon Web Services (AWS) environment that will provide even greater security and scalability. Vastly increased EHR clinical data and new services, like Episodes and Improvements, call more data simultaneously to populate views. Our move to AWS helps to ensure that greater insights don’t come at the expense of performance.
AWS is used by the largest governmental and private organizations, including health care, and provides additional security features for Roji applications and our clients’ data. The final transition will be complete in spring 2021.
Roji Health Intelligence production servers are currently located in an ultra-secure facility meeting the highest standards in the industry. The facility is an SAS 70 II/SSAE 16 compliant co-location, and has successfully attained SOC 2 Type 2 and SOC 3 reports. We have a redundant system backup at AWS, which provides SOC 1, SOC 2, and SOC 3 reports via the AWS Artifact. Regardless of the environment, we maintain strict physical and user access restrictions to all Roji applications and data.
What data security protections exist in the processing of data?
How is data protected from hackers?
In keeping with high security standards, the web portal and database are on separate servers, to protect immediate access to the data. Data is encrypted and appears only as needed through Roji Health Intelligence Applications. Our Applications undergo routine, frequent security reviews and testing to ensure that they remain safe from hacking.
How is data shared with others?
Patient and Practice data is seen only within the client organization and is specified in Roji Health Intelligence Business Associate Agreements. Clients who participate in benchmarking may agree to see aggregate, unidentified results of other clients but no patient data is shared outside of the organized health system stipulated in the Roji Health Intelligence Services Agreement and Business Associate Agreement.
Do patients need to authorize the collection or use of patient data?
Not typically. Patient data related to quality is permissible to share under HIPAA because it is part of health care operations, as long as Business Associate Agreements and underlying practices protect its privacy to this purpose. Also, Roji Health Intelligence restricts that sensitive data which may require patient consent.
How is access to the data secured?
Role-based User Access
The 3-2-1 Rule states the following:
How does Roji backup its data?
At Roji Health Intelligence, we take our backups seriously. This is not just to cover CMS or HIPAA requirements, this is to satisfy ourselves; that we are actively ensuring the integrity of the data given to us, and that we are using it to verify the reporting created by the data is valid. We use the 3-2-1 Backup
Rule at Roji Health Intelligence. All of our data is encrypted at rest, both production data and static backups.
