Last Updated: 23 September, 2026

Health Insurance Portability and Accountability Act (HIPAA)

Supporting Healthcare Organizations

Softhealer Technologies Pvt. Ltd. ("Softhealer", "we", "our", or "us") develops and operates Monitor360, an enterprise workforce monitoring and productivity platform.

We understand the importance of protecting sensitive information within healthcare environments and are committed to implementing appropriate security and privacy practices to support organisations operating under the Health Insurance Portability and Accountability Act (HIPAA).

This page explains how Monitor360 supports healthcare organisations through security-focused platform design, operational safeguards and privacy best practices.

For information regarding personal data processing, please refer to our Privacy Policy. For detailed technical safeguards, please refer to our Security page.

1. Our Approach to HIPAA

Monitor360 is designed with security, privacy and operational controls that help healthcare organisations protect sensitive information within their environments.

HIPAA is built on three core rules that our compliance programme is designed to support:

Privacy Rule — governs permitted uses and disclosures of PHI. Monitor360 processes workforce activity data only for service delivery purposes and does not use or disclose customer data for any other purpose.

Security Rule— requires administrative, physical and technical safeguards to protect electronic PHI (ePHI). Our safeguards are documented in Sections 3–5 and independently validated through our ISO/IEC 27001:2022 and SOC 2 Type II certifications.

Breach Notification Rule — requires notification of PHI breaches. Softhealer Technologies will notify customers of a confirmed PHI breach within 60 calendar days of discovery, as defined in our BAA.

While Monitor360 provides security features and administrative controls that support organisations operating under HIPAA, healthcare organisations remain responsible for ensuring that their implementation and use of Monitor360 complies with applicable HIPAA requirements.

2. Business Associate Relationship

When Monitor360 is used by healthcare organisations that qualify as Covered Entities or Business Associates under HIPAA, Softhealer Technologies Pvt. Ltd. may act as a Business Associate with respect to Protected Health Information (PHI) processed through the platform.

Where applicable, Softhealer Technologies Pvt. Ltd. offers a Business Associate Agreement (BAA) to define each party's responsibilities regarding the protection of PHI.

3. Administrative Safeguards

Monitor360 supports administrative security practices through:

• Designated HIPAA Privacy Officer and Security Officer
• Regular security risk assessments and risk management
• Workforce security awareness training
• Role-Based Access Control (RBAC)
• Administrator and user role separation
• Secure user authentication
• Security-focused operational procedures
• Incident response processes
• Business continuity planning
• Disaster recovery procedures

Healthcare organisations remain responsible for establishing their own administrative safeguards, workforce training, internal security policies and compliance programmes.

4. Technical Safeguards

Monitor360 incorporates multiple technical safeguards designed to help protect customer information.

Current technical controls include:

• TLS 1.2 encryption for data in transit
• AES-256 encryption for data at rest
• Multi-factor authentication (MFA) support
• Audit logging of system access and user activity
• Automatic session timeout
• Secure user authentication
• Role-Based Access Control (RBAC)
• Secure cloud infrastructure
• Daily database backups
• Redundant storage for user-generated files
• Disaster recovery procedures
• Configurable monitoring controls

Detailed information regarding our technical safeguards is available on our Security page.

5. Physical Safeguards

Monitor360 is hosted on Amazon Web Services (AWS).

Physical protection of the underlying infrastructure, including data centres, environmental controls and physical access management, is provided by AWS in accordance with its published security standards.

Softhealer Technologies Pvt. Ltd. is responsible for securing the Monitor360 application and associated services deployed within this infrastructure.

6. Protected Health Information (PHI)

Monitor360 is not designed to function as an Electronic Health Record (EHR) system.

Healthcare customers remain responsible for determining what information is processed through Monitor360 and for ensuring that Protected Health Information (PHI) is handled in accordance with applicable laws and organisational policies.

Customers should configure Monitor360 appropriately to minimise unnecessary processing of sensitive information.

7. Shared Responsibility

HIPAA compliance is a shared responsibility.

Softhealer Technologies Pvt. Ltd. is responsible for:

• Operating and securing the Monitor360 platform.
• Maintaining secure cloud infrastructure.
• Protecting customer information processed through our services.
• Applying security updates and platform maintenance.
• Managing backup and disaster recovery procedures.
• Supporting customers through appropriate contractual and technical safeguards.

Customers are responsible for:

• Determining whether Protected Health Information (PHI) is processed.
• Configuring Monitor360 appropriately.
• Managing user accounts and access permissions.
• Establishing HIPAA-compliant internal policies and procedures.
• Training workforce members on HIPAA requirements.
• Responding to regulatory obligations.
• Complying with the HIPAA Privacy Rule, Security Rule and Breach Notification Rule.

8. Business Associate Agreement (BAA)

Softhealer Technologies Pvt. Ltd. offers a Business Associate Agreement (BAA) for eligible healthcare customers.

Our BAA defines each party's responsibilities for safeguarding Protected Health Information (PHI), including:

• Permitted uses and disclosures of PHI
• Administrative, physical and technical safeguards
• Security incident and breach notification responsibilities
• Subcontractor obligations
• Return or secure destruction of PHI
• Termination provisions

Customers requiring a BAA may request one during onboarding or at any time during their subscription.

9. Compliance & Certifications

Softhealer Technologies Pvt. Ltd. is committed to maintaining internationally recognised standards for information security, quality management and privacy.

Independently Audited Certifications:

• ISO/IEC 27001:2022 Information Security Management System (ISMS)
• ISO 9001:2015 Quality Management System (QMS)
• SOC 2 Type II – System and Organisation Controls 2
• SOC 1 Type II – System and Organisation Controls 1

Compliance Frameworks & Agreements

• General Data Protection Regulation (GDPR) — supported via Data Processing Agreement (DPA)
• Health Insurance Portability and Accountability Act (HIPAA) — supported via Business Associate Agreement (BAA)
• Data Processing Agreement (DPA)
• Business Associate Agreement (BAA)

These certifications & frameworks demonstrate our commitment to maintaining secure, reliable and privacy-focused services for customers across multiple industries

10. Contact Us

If you have questions regarding HIPAA, healthcare privacy, Business Associate Agreements (BAA) or the protection of Protected Health Information (PHI), please Contact Us using the contact information available on our website.