Trust Home / Security
Security overview
Cernia FHIR is designed with security as a first-class concern. Every architectural decision is documented in an Architecture Decision Record (ADR) and is publicly accessible in the manifest below.
Four pillars of security
Access Control
Role-based access control (RBAC) and attribute-based access control (ABAC) enforce the principle of least privilege across all FHIR resources. ServiceAccounts and API keys are scoped to minimum-required permissions. SMART on FHIR 2.0 launch sequences with PKCE are enforced for all app integrations.
Data Protection
All data is encrypted at rest (AES-256) and in transit (TLS 1.2+). PHI-bearing FHIR resources carry a `phiPolicy` marker that triggers enhanced audit logging. Customer data is logically isolated per tenant. No cross-tenant data leakage is possible by design.
Audit Trail
Every read, write, delete, and administrative action is appended to an immutable TimescaleDB audit log. Audit events include principal identity, resource type, resource ID, timestamp, IP address, and outcome. The audit chain uses cryptographic chaining (SHA-256 hash of preceding event) to detect tampering.
Compliance
Cernia FHIR is HIPAA-ready (Business Associate Agreements available). SOC 2 Type 2 audit completed April 2026 — report on request. HITRUST e1 assessment beginning July 2026. ONC 2015 Edition Health IT certification roadmap in progress. US Information Blocking Rule compliance (§170.300) enforced via policy.
Architecture Decision Records (ADRs)
All architectural decisions that affect security, data handling, or compliance are documented as ADRs. The following manifest is generated at build time from the docs/architecture/decisions/ directory.
| ADR ID | Title |
|---|---|
| ADR-0003 | Encryption at rest and in transit |
| ADR-0005 | Pluggable Identity Provider (SAML, OIDC, LDAP) |
| ADR-0010 | AI/ML primitives (Workflow, MLModel, AIAgent) |
| ADR-0011 | Integration platform (Connection, ConnectionRun, ConnectionTemplate) |
| ADR-0012 | Workflow authoring (Bot) |
| ADR-0013 | Configuration & TenantPolicy |
| ADR-0014 | Customer UI route structure |
| ADR-0015 | ServiceAccount lifecycle |
| ADR-0016 | GDPR audit retention vs right-to-erasure |
| ADR-0017 | API key rotation policy |
| ADR-0018 | Reviewer-of-record |
| ADR-0020 | Security posture, breach detection, and audit alerts |
| ADR-0021 | US Healthcare Regulatory (42 CFR Part 2, ONC §170.300) |
| ADR-0022 | Customer-Facing Trust & Communications (Phase 17) |
Full ADR text is available to customers who have signed an NDA or BAA. Contact your account manager or security@cerniahealth.com to request access.
Have a security question?
Reach our security team or read the responsible disclosure policy.