Building HIPAA-ready messaging: what the framework actually requires

"HIPAA-compliant" is one of the most-abused labels in enterprise software. HIPAA is a regulation, not a certification — there is no auditor who stamps your product. What HIPAA actually requires is that Covered Entities (and their Business Associates) implement specific safeguards and sign Business Associate Agreements.

The safeguards, in plain English

• Administrative: written policies, training, incident response, workforce clearance
• Physical: facility access controls, device disposal, workstation security
• Technical: access control, audit logs, integrity controls, encryption

What Raftar API provides on the technical side

• End-to-end TLS 1.2+ for every message hop
• AES-256 at rest with per-tenant key derivation
• Field-level encryption for provider credentials
• Tamper-evident audit logs (SHA-256 hash chain) covering every access and mutation
• PHI redaction in outbound webhook payloads when configured
• US-East, EU, and AU data residency options

The BAA

A signed Business Associate Agreement is required before you can send PHI through the platform. We ship a pre-negotiated BAA to Business+ customers within one business day. Enterprise customers can request custom terms.

HIPAA does not ban cloud vendors. It requires that you know what your vendors are doing with your data.

— HHS Office for Civil Rights, informal guidance