Healthcare Beta · Security Platform

One platform for HIPAA, HITECH, and patient-visible audit.

Hospitals, EHR vendors, payers, telehealth, and digital-health platforms operate inside an audit perimeter that doesn't forgive mistakes. The Security Platform is designed with HITECH breach-notification hooks and per-patient audit visibility customers can show their own end users. Tessarac does not sign Business Associate Agreements today.

Not available yet. This page describes the Security Platform we are building; ACOG is the product you can use today.

Talk to us See what's available now

Regulatory posture

HIPAA + HITECH + 21 CFR Part 11 + state privacy laws.

Modern healthcare platforms map to HIPAA Security Rule technical safeguards, HITECH breach notification, 21 CFR Part 11 (electronic records), plus the patchwork of state privacy laws (CMIA in California, MHMDA in Washington). Tessarac's per-tenant compliance presets are designed to configure these baselines and collect the evidence.

  • HITECH breach notification hooks — designed to fire your notification webhook on a detection, so you can act within the regulated window
  • 21 CFR Part 11 — electronic-records integrity via the hash-chained, tamper-evident audit log
  • CMIA (California Confidentiality of Medical Information Act) + MHMDA (WA My Health My Data Act) controls documented
  • Per-patient audit visibility — customers can show end users who accessed their record and when

The healthcare-shaped deployment

Patient identity, clinician identity, system identity, brokered access to EHR backends — one platform, one audit log.

  • Patient identity (CIAM)

    Passkeys, magic links, social federation for the patient side. Branded hosted UI per affiliate brand. Per-tenant audit log surfaced inside the patient portal so users can see their own access history.

  • Clinician + admin SSO

    Workforce SSO for clinical and admin staff. Smart-card sign-in planned for paid plans, and to be required by default on the planned Federal plan. SCIM provisioning from your HR system.

  • Brokered access to EHR backends

    SSH, RDP, database protocol proxy for the systems that hold PHI. Every session MFA-challenged, every command logged, every screen recorded. Just-in-time approvals; zero standing privilege.

  • Per-patient audit, exportable

    Every PHI access lands in the per-patient audit chain. Patients see their own record-access history. Hospitals export to their existing SIEM, any object-storage bucket they own, or to a syslog destination — opt out of Tessarac retention entirely if needed.

Why healthcare is different

The audit isn't optional and the patient is the second auditor.

In most industries the auditor visits once a year. In healthcare, the patient can request the access log on their own record at any time. The Security Platform is designed with the patient-visible audit as a first-class feature, so your customers won't have to build it.

  • Per-patient access history visible inside the patient portal — no separate engineering project
  • Log retention with operator opt-out — customers may opt out of Tessarac retention entirely
  • Tamper-evident audit chain — verify the chain from any starting block to any ending block
  • Per-customer logical isolation by default, with the planned Dedicated HSM add-on for per-customer key isolation

Talk to a Tessarac healthcare architect

The Security Platform is in beta, and Tessarac signs no BAAs today. Design partners help shape the healthcare path.

Get a demo Read the docs