Trust at Indigo Health
Healthcare software lives or dies on trust. We built Indigo Health so that trust isn't a marketing claim — it's the architecture.
This page is the short version. The full policy library and BAA are available to prospects and customers under NDA, and our team is happy to walk your security and compliance reviewers through any of it.
We're a business associate. That's it.
Indigo Health doesn't practice medicine, doesn't supervise clinicians, and doesn't decide what counts as a medical record. Our customers — the Covered Entities who treat patients — make those decisions, and we process PHI only as their BAA directs.
A single, focused legal role means fewer surprises in your vendor risk review and a cleaner story for your regulators.
Your patient data isn't on our laptops. By design.
The single most important thing about how Indigo Health is built: PHI never lands on laptops, analytics warehouses, or test environments. We call this our minimum-access PHI architecture, and it's not a policy we ask people to follow — it's how the platform is built:
- PHI stays inside our production trust boundary — the database and the BAA-covered services that process it — and never spreads beyond it.
- Our workforce does not routinely access PHI to do their jobs. Internal tools surface the operational context our team needs — without exposing the underlying clinical content.
- Access events are logged with user, time, and component metadata, with no PHI payloads in the logs themselves. The audit trail is rich; the data exposed by the audit trail is not.
- The narrow exceptions, such as emergency "break-glass" access, require dual authorization and are fully logged and reviewed.
When a vendor is breached, every Covered Entity asks the same question: "How much of our patient data did that vendor have sitting around?" For Indigo Health, the honest answer is: it stayed within production controls, and it was never on anyone's laptop.
Built on infrastructure your reviewers already trust.
The platform runs on Microsoft Azure, on HIPAA-eligible services covered by Microsoft's BAA — inheriting enterprise-grade physical security and the global compliance certifications of one of the most heavily audited cloud platforms in the world. PHI is encrypted in transit and at rest. For email that may touch PHI, we use Paubox for HIPAA-compliant delivery.
We don't ask you to take our infrastructure on faith — we build on a foundation your own auditors have almost certainly assessed before.
A complete HIPAA Security Rule program — in writing.
Compliance shouldn't be a vibe. Ours is a documented library of policies and procedures, organized to the HIPAA Security Rule, so your reviewers can map our controls to the regulation directly.
Administrative
Physical
Supply chain
Vendor & supply chain — documented subprocessor management; every PHI-handling third party bound by HIPAA-compliant agreements.
Technical
This isn't a slide deck. It's a maintained, version-controlled library that our own team operates against every day.
Vendor reviews, made easy.
We know what a vendor risk questionnaire looks like.
We've designed our compliance posture so the answers are ready before you ask.
Evidence that holds up — not just claims.
Every control above produces a trail. Activity is captured in tamper-resistant, append-only logs, and governed evidence is retained in a write-once evidence repository built to satisfy a regulator, not just check a box. When a reviewer asks "show me," the answer is documented evidence with a date on it — available for review by customers and regulators.
When something happens, you'll hear from us.
We notify affected customers of confirmed security incidents involving their PHI in accordance with the executed Business Associate Agreement and HIPAA's Breach Notification Rule. Incident triage, containment, and notification are governed by our Security Incident Response and Breach Notification Policy and the supporting procedures — so the response on the worst day isn't improvised.
Last reviewed: June 2026
@ Talk to us
Contact formSecurity and compliance reviewers — we'd rather meet you early than late. Reach us at security@indigo.health, or for general inquiries, hello@indigo.health.