TRUST
The trust layer ships first
PHI minimization, purpose-of-use, immutable audit and BAA-ready operations exist before advanced features ship — Phase 1 scope, not a hardening sprint. VeloCare holds the minimum PHI needed to run engagement operations, and proves every touch of it.
Minimum necessary by design
Every portal surface enumerates its data needs. Marketing roles never see clinical adjacency; relations sees cases, not charts; the schema itself omits diagnosis, medication, order and result tables — absence is the enforcement.
Consent is unoverridable
Every outbound message — campaign, reminder, chase, survey, agent-initiated — calls the consent engine synchronously at delivery time. Denies cite their rule and are logged. Marketing is default-deny until opt-in; TCPA consent is recorded with provenance.
Provable, not promised
"Who saw this patient and why" is one query. Every PHI view, export, message, consent change and AI action lands in an append-only, hash-chained audit log with actor and purpose — 7-year retention, verified nightly.
AI under governance
Pinned model versions per task class, PHI redaction before prompts, BAA-covered endpoints only, no training on tenant data. Escalation classes for clinical signals, identity, consent and legal language are enforced in the runtime — outside the model. Kill switches per agent, per tenant, instant.
HIPAA posture
Velozent signs BAAs as business associate; the subprocessor register (cloud, models, Twilio/SendGrid, clearinghouse) is customer-visible. No PHI reaches any vendor without a BAA. No PHI in URLs, logs or analytics events — by construction.
Encryption & lifecycle
TLS 1.2+ in transit, AES-256 at rest, secrets in vault, per-tenant key scoping in customer-tenant deployments. Retention schedules per object type with legal hold; disposal produces certificates. Breach workflow with notification clocks, twice-yearly tabletop exercises.
HIPAA Security Rule risk assessment — pre-PHISOC 2 Type II — within 12 months of GAAnnual penetration test
Compliance evidence comes from the audit spine, not from log spelunking — signed export bundles on request.