Built for hospitals that handle PHI
Hospital buyers need to know how patient information is protected. This page describes how Afloat is built, in plain terms, and what we do and do not claim.
How Afloat is built
Afloat runs on Amazon Web Services (AWS) in the United States. These are the main protections in place; we share more detail with customers under NDA as part of a security review.
Encryption in transit and at rest
Traffic to Afloat is encrypted with TLS. Data stored in our database and file storage is encrypted at rest using AWS-managed encryption.
Separation between hospitals
Each hospital's data is kept separate from every other hospital's, and access is limited to that hospital's own authorized users.
Audit logging
Activity in Afloat is recorded, so changes can be traced and reviewed.
Role-based access
People see and do only what their role allows, and privileged accounts are protected with multi-factor authentication.
Network protection
Our web applications are protected against common internet attacks.
Data export and deletion
On request, we can provide an export of a hospital's data or delete it, with safeguards to prevent mistakes.
HIPAA
Afloat is designed for hospitals that handle protected health information (PHI).
- Business Associate Agreements. We sign Business Associate Agreements (BAAs) with our hospital customers.
- HIPAA-eligible AWS services. We build on AWS services that AWS lists as eligible for use with PHI, and we operate under AWS's BAA.
- Shared responsibility. HIPAA compliance depends on how a service is built and how it is used. Your agreement with us sets out the responsibilities on each side.
HIPAA has no official certification, so you will not see a "HIPAA certified" badge here. We would rather tell you exactly what we do. We do not currently describe Afloat as holding any third-party security certification.
Security review forms or questionnaires? Send them to us and we will respond.
How we use AI
Afloat includes optional AI-assisted features that save staff time, such as drafting a discharge summary or a shift handoff for a person to review.
- People stay in charge. AI output is a draft. A staff member reviews it before it is used.
- Only what is needed. A request uses a hospital's own information for that hospital, to answer that request.
- Inside AWS. AI features run within AWS's infrastructure.
- No training on PHI. We do not use PHI, or any customer data, to train or fine-tune AI models.
Security contact
Report a security concern or ask a security question at security@afloathub.com. See our vulnerability disclosure policy and our subprocessor list.
Have a security questionnaire?
Send it over with your demo request and we will respond.
