System Security
Explore the encryption, access controls, and platform protections that safeguard sensitive data across all DekkoSecure services.
HIPAA Compliant Secure File Sharing for Healthcare
DekkoSecure supports healthcare organisations in meeting their obligations under the Health Insurance Portability and Accountability Act (HIPAA) by providing the technical safeguards required to protect electronic Protected Health Information (ePHI). The platform's zero-knowledge encryption, access controls, and audit logging address the Security Rule, Privacy Rule, and Breach Notification Rule requirements that apply when ePHI is stored, shared, or accessed through a cloud-based platform.
Compliance Approach
How does DekkoSecure support HIPAA compliance?
HIPAA does not offer a formal certification or government endorsement for software platforms. Compliance is demonstrated through the technical, administrative, and physical safeguards an organisation has in place to protect ePHI.
DekkoSecure's architecture is built to provide the technical safeguard layer that covered entities and their partners need when sharing sensitive healthcare data externally.
Background
What is HIPAA and what does it require for file sharing?
HIPAA is a United States federal law that establishes national standards for protecting individuals' medical records and personal health information. It applies to covered entities (healthcare providers, health plans, and healthcare clearinghouses) and their business associates, the third-party service providers that handle ePHI on their behalf.
For organisations that share healthcare data through cloud platforms, HIPAA's Security Rule is the most directly relevant component. It requires three categories of safeguards.
Safeguard
Technical
Governs the technology used to protect ePHI and control access to it. Includes encryption, access controls, audit controls, integrity controls, and transmission security.
Safeguard
Administrative
Covers the policies and procedures an organisation puts in place to manage the selection, development, and maintenance of security measures. Includes workforce training, risk analysis, and contingency planning.
Safeguard
Physical
Addresses physical access to systems and facilities where ePHI is stored or processed, including data centre security, workstation controls, and device management.
A cloud file sharing platform primarily needs to address the technical safeguards, while supporting the administrative and physical safeguard requirements through its infrastructure, policies, and contractual commitments.
Technical Safeguards
How does DekkoSecure address HIPAA technical safeguards?
DekkoSecure's architecture addresses each of the five HIPAA technical safeguard requirements through cryptographic, access, and audit controls embedded directly at the application layer, exceeding the HIPAA baseline in several areas.
Encryption of ePHI
All content shared through DekkoSecure is end-to-end encrypted using AES-256 for symmetric file and message keys and ECC-384 for user key pairs. Encryption and decryption occur on the user's device. DekkoSecure operates a zero-knowledge model, meaning that even as the service provider DekkoSecure cannot access or decrypt any customer data. This exceeds the HIPAA encryption requirements, which call for protection of ePHI at rest and in transit but do not mandate zero-knowledge architecture.
Access controls
Hub-based permissions control who can view, download, share, or manage content. The platform supports SSO integration, multi-factor authentication, and configurable session controls, enforced through a Zero Trust model. These controls address the HIPAA requirement for unique user identification, emergency access procedures, automatic logoff, and role-based access.
Audit controls
All actions generate immutable, tamper-evident audit logs that cannot be modified or deleted by any user, including administrators. Logs capture file access, sharing events, authentication activity, and permission changes. This supports the HIPAA requirement to record and examine activity in systems that contain or use ePHI.
Integrity controls
DekkoSecure's encryption and audit logging ensure that ePHI cannot be altered or destroyed without detection. Tamper-evident records provide a verifiable history of all changes to content and access permissions.
Transmission security
All data transmitted between users and the platform is encrypted end-to-end. The zero-knowledge model ensures that ePHI is never exposed in plaintext during upload, storage, transit, or review, even to DekkoSecure's own infrastructure.
Who Benefits
File sharing that complies with HIPAA for healthcare organisations
DekkoSecure supports healthcare organisations and their partners that need to share sensitive patient data securely across organisational boundaries while meeting HIPAA requirements.
Hospitals and health systems sharing patient records with external specialists, clinics, or legal representatives.
Health technology companies managing data exchange between providers, laboratories, and government health agencies.
Aged care and allied health providers collaborating on patient care with external practitioners.
Research institutions sharing clinical data with partner organisations under strict privacy controls.
Healthcare business associates that handle ePHI on behalf of covered entities and need to demonstrate their own HIPAA-aligned safeguards.