Compliance
Regulatory frameworks and certifications supporting your compliance obligations.
Last updated: July 2026
HIPAA
RESIDORA maintains administrative, physical, and technical safeguards aligned with HIPAA requirements.
- Business Associate Agreement (BAA) available for all customers
- Administrative safeguards: workforce training, security officer, policies and procedures
- Physical safeguards: facility access controls via cloud provider (AWS)
- Technical safeguards: access controls, encryption, audit logs, integrity controls
- Annual HIPAA training for all employees with access to PHI
- Documented breach notification procedures
State Regulations
Beyond federal HIPAA requirements, we support state-specific regulations:
- California: CCPA/CPRA compliant data handling
- Texas: HB 300 compliance for health information
- New York: SHIELD Act compliance
- State-specific breach notification procedures
- EVV compliance for applicable states and payers
International Compliance
For customers operating in multiple jurisdictions:
- UK: Data Protection Act 2018 / UK GDPR alignment
- Australia: Privacy Act 1988 compliance, Australian data residency
- GCC: PDPL-aware data handling, regional hosting options
- Data Processing Agreements (DPA) available
- Data residency options for applicable regions
Audits & Assessments
Regular third-party validation of our security and compliance controls:
- Annual third-party security assessment
- Annual penetration testing by qualified firm
- SOC 2 Type II certification (in progress)
- Audit reports available to customers under NDA
Need compliance documentation?
BAAs, DPAs, and security questionnaire responses available upon request.