How does H33-Health satisfy HIPAA technical safeguards?
H33-Health maps directly to HIPAA §164.312. Access control (§164.312(a)) is enforced via HMAC-SHA3 zero-knowledge authentication. Transmission security (§164.312(e)) uses Kyber-1024 encrypted channels. Integrity controls (§164.312(c)) are provided by SHA3-256 tamper-evident hashing. Audit controls (§164.312(b)) use Dilithium-signed immutable logs. Every requirement is addressed with post-quantum cryptography.
What does zero-knowledge eligibility verification mean for insurers?
A provider can verify that a patient is eligible for a specific procedure without learning the patient's full insurance details, and the insurer confirms eligibility without learning the patient's diagnosis. H33-Health uses ZK proofs to answer yes/no eligibility questions on encrypted data. Both sides get the answer they need. Neither side sees the other's private information.
How does FHE enable clinical trial matching?
Clinical trial criteria (age ranges, biomarker thresholds, diagnosis codes) are encoded as FHE computations. Patient records are encrypted with BFV and submitted for matching. The computation runs entirely on ciphertext, producing an encrypted yes/no result that only the patient's provider can decrypt. The trial sponsor never sees the patient's data. The provider never sees other patients' results.
What's the BAA process?
H33 executes Business Associate Agreements for all Health-tier customers. The BAA covers all PHI processed through H33-Health APIs, including FHE-encrypted data (which H33 cannot decrypt). BAA execution is handled during onboarding and typically completes within 48 hours. Custom BAA terms are available for enterprise accounts. The BAA is available for review before you sign up.
Does H33-Health integrate with Epic and Cerner?
Yes. H33-Health provides pre-built adapters for Epic (via FHIR R4 APIs and MyChart integration), Cerner (Oracle Health FHIR endpoints), and other major EHR systems. The adapter handles authentication with the EHR, encrypts PHI fields with Kyber-1024 on extraction, and returns encrypted records ready for FHE computation or secure storage. HL7 v2 ADT feeds are also supported.
Is H33-Health HL7 FHIR compatible?
Yes. H33-Health accepts and returns FHIR R4 resources (Patient, Observation, Condition, Coverage, Claim). PHI fields within FHIR resources are individually encrypted with Kyber-1024 while structural fields (resource type, identifiers) remain in cleartext for routing. This means your FHIR workflows continue to function while the sensitive content is post-quantum encrypted.
What happens during a HIPAA audit?
H33-Health generates audit-ready reports that map every API operation to the relevant HIPAA §164.312 control. Each entry in the audit trail is Dilithium-signed and independently verifiable. Reports include: who accessed what PHI (by role, not individual if de-identified), when, from where, and what operation was performed. Reports export as PDF or JSON for your compliance team or OCR auditors.
Does H33-Health support field-level encryption?
Yes. H33-Health encrypts at the field level, not the record level. A patient record can have the name, SSN, and diagnosis encrypted with different keys and different access policies, while the record ID and care team assignment remain in cleartext for routing. This enables fine-grained access control: a billing clerk can decrypt insurance fields but not clinical notes.
Can researchers query patient data without seeing PHI?
Yes. This is one of H33-Health's core use cases. Researchers submit queries as FHE computations (e.g., "count patients with diagnosis X and lab value above Y"). The computation runs on Kyber-encrypted records using BFV FHE arithmetic. The researcher receives an encrypted aggregate result that their institution decrypts. Individual patient records are never exposed at any point in the pipeline.
How does H33-Health handle consent management?
H33-Health includes a consent ledger where patient consent directives are stored as Dilithium-signed records. Each data access request is checked against the consent ledger before processing. Consent can be scoped by data category (clinical, billing, research), recipient, and time window. Patients can revoke consent via the API, and all subsequent access attempts are denied and logged.
How is de-identification handled?
H33-Health supports both HIPAA Safe Harbor (removal of 18 identifiers) and Expert Determination methods. With FHE, there's a third option: compute on encrypted data without de-identifying at all, because the compute engine never sees plaintext. For data exports, the de-identification pipeline strips or generalizes identifiers per your configured policy, with a Dilithium-signed attestation that the process was applied.
What are breach notification obligations when data is FHE-encrypted?
Under the HIPAA Breach Notification Rule, if PHI is encrypted to NIST standards and the encryption key was not compromised, it qualifies for the safe harbor exemption from notification. H33-Health's Kyber-1024 encryption exceeds NIST requirements. If encrypted data is exfiltrated but keys remain secure, you have a strong argument that no breach notification is required. H33 provides documentation to support this position.
How does multi-tenant PHI isolation work?
Each tenant (hospital, clinic, insurer) gets a dedicated Kyber-1024 key hierarchy. PHI from Tenant A is encrypted with keys that Tenant B's infrastructure cannot access. At the infrastructure level, tenant data is stored in isolated partitions with separate encryption contexts. Even if a storage-level breach occurred, cross-tenant decryption is cryptographically impossible without the other tenant's keys.
What's the BAA turnaround time and what does it cover?
Standard BAAs are executed within 48 hours of request. The BAA covers all PHI transmitted to, processed by, and stored within H33-Health infrastructure, including FHE-encrypted data that H33 cannot decrypt. It covers subcontractors (cloud infrastructure providers) and includes breach notification obligations, permitted uses, and termination provisions per 45 CFR §164.504(e).
How does H33-Health handle state-specific health privacy laws?
H33-Health's field-level encryption and consent ledger are configurable per jurisdiction. For California (CCPA/CMIA), consumer health data has additional access and deletion rights enforced at the API layer. For Washington (My Health My Data Act), sensitive health data categories receive elevated encryption and consent requirements automatically. Policy configurations for all 50 states are available and updated as legislation changes.