Free Billing Audit
Home / Compliance & Security

HIPAA & SOC 2 Security Architecture:
Enterprise Data Protection & Zero Local PHI Storage

MiraiCure maintains 100% HIPAA-HITECH compliant operations, SOC 2 Type II certified data workflows, and encrypted remote access directly into US-based EHRs without offshore local caching of Protected Health Information.

100% HIPAA & HITECH Certified
SOC 2 Type II Audited
256-Bit Encrypted IPsec VPNs
24 / 7 Monitored IT Facility
Security Standard

Our 12 Pillars of Compliance & Patient Privacy

MiraiCure enforces stringent physical, technical, and administrative safeguards to guarantee complete confidentiality of every medical claim.

01

Physical Access Control

  • Biometric fingerprint scanning and proximity card readers at all perimeter entrances.
  • Mandatory photo ID badge display required for all workforce representatives at all times.
  • Granular role-based physical access configured on a least-privilege basis per employee.
  • Continuous auditing of electronic access logs to detect and alert on unauthorized door attempts.
02

24/7 Facility Security

  • Uniformed physical security personnel stationed on 24-hour duty at all facility gates.
  • Strict registration of all visitor details, government ID verification, and purpose of visit.
  • Physical visitor registers archived securely for a minimum mandatory retention period of 10 years.
  • Direct police panic buttons and integrated emergency response protocols.
03

Continuous CCTV Surveillance

  • High-definition CCTV coverage across all facility access points, corridors, and operational floors.
  • Digital video recordings retained on internal central DVR hard disks for 6 months minimum.
  • Secondary encrypted backup to offsite secure cloud facilities for long-term audit preservation.
  • Random unannounced spot monitoring of live video feeds by security intelligence personnel.
04

Strict Vendor Escort Protocols

  • Mandatory execution of legally binding Non-Disclosure Agreements prior to physical site entry.
  • Continuous 100% human escort by designated internal supervisors in sensitive server zones.
  • Pre-authorized visitor scheduling with identity cross-checking before facility pass issuance.
  • Prohibition of any vendor recording equipment, laptops, or external memory devices.
05

Clean-Floor Mobile Phone Ban

  • Cellular phones and personal recording devices strictly prohibited on the production floor.
  • All employees deposit mobile devices into biometric exterior security lockers before entering.
  • Metal detection scanners stationed at the floor threshold to enforce zero personal electronics.
  • Authorized floor supervisors equipped with dedicated monitored company intercoms only.
06

Personal Baggage Prohibition

  • Zero bags, backpacks, purses, or carriers permitted inside the production workspace.
  • Exterior individual secure lockers provided for all staff personal items outside security doors.
  • Pen-and-paperless environment: no paper records or printing capabilities on billing floors.
  • Ensures zero physical transmission vectors for any patient information.
07

Active Directory & Group Policy

  • Domain Group Policy centrally manages user access, password complexity, and 90-day rotation.
  • USB mass storage, optical drives, and external memory ports physically and logically disabled.
  • Local workstation printer sharing blocked; network print jobs restricted to authorized leads.
  • Automatic screen timeouts after 3 minutes of inactivity with re-authentication required.
08

Next-Gen UTM Firewall & IPS

  • Unified Threat Management (UTM) firewall with real-time Deep Packet Inspection (DPI).
  • Default-deny ingress/egress rules: all unauthorized web traffic and peer-to-peer protocols blocked.
  • Intrusion Prevention System (IPS) updated dynamically with global vulnerability signatures.
  • Firewall traffic logs maintained continuously and archived for 1 year for compliance audits.
09

Encrypted Site-to-Site IPsec VPN

  • Direct site-to-site 256-bit AES encrypted IPsec tunnels linking our facility to client EHRs.
  • VPN endpoints locked to static client and server gateway IP addresses; zero open public ports.
  • Client-to-site multi-factor authentication (MFA) required for all authorized billing directors.
  • Prevents man-in-the-middle attacks and eavesdropping across public transit networks.
10

Zero Local PHI Storage

  • Our billing specialists log remotely into your EHR without local hard drive caching of charts.
  • All claims, patient demographics, and financial statements remain safely hosted on US servers.
  • Workstation hard drives encrypted with BitLocker 256-bit AES encryption.
  • Centralized endpoint detection and response (EDR) antivirus with real-time malware scrubbing.
11

Workforce Training & Vetting

  • 100% comprehensive criminal and academic background verification prior to issuing job offers.
  • Mandatory annual HIPAA-HITECH certification training and testing for all staff members.
  • Strict non-disclosure agreements executed under severe civil and contractual penalties.
  • Immediate access revocation protocol executed upon employee role change or departure.
12

Business Associate Agreement (BAA)

  • Formal HIPAA Business Associate Agreement executed with every healthcare client prior to onboarding.
  • Contractual guarantee of breach notification protocols within 24 hours of any suspected incident.
  • Full cooperation with client compliance officers and annual third-party security audits.
  • Complete alignment with HHS Office for Civil Rights (OCR) regulatory guidelines.
Executive BAA Protocol

Need a Custom BAA or Security Architecture Review?

Our Chief Information Security Officer will meet with your practice compliance committee to review VPN setup, EHR access permissions, and mutual liability safeguards.

Contact Compliance Leadership →