Guides
HIPAA for Integrators
What HIPAA means for your OnePath integration, and what you need to do.
OnePath Connect is HIPAA-compliant infrastructure. But integrators also have HIPAA obligations. This guide explains the shared responsibility model.
What OnePath handles
- HIPAA-compliant data storage (Azure HIPAA BAA in place)
- PHI encryption at rest (AES-256) and in transit (TLS 1.3)
- Access logging and immutable audit trail on every PHI operation
- Per-partner FHIR isolation — your users' data is never commingled with another partner's
- BAA with your organization (required before production access)
What you're responsible for
| Obligation | Notes |
|---|---|
| Your own BAA with OnePath | Required before production credentials are issued |
| Consent from your users | You must collect and document informed consent before onboarding users |
| Transmission security | All requests must use HTTPS — never transmit API keys or tokens over HTTP |
| Key management | Rotate API keys annually at minimum; rotate immediately if compromised |
| Minimum necessary | Only submit PHI that's required for your specific use case |
| Breach notification | If you detect a breach involving OnePath data, notify security@onepath.health immediately |
Audit Log Access
Every PHI access through your partner key is logged. You can retrieve your audit log via the Partner Portal or via API:
GET /partner/v1/audit-log?from=2026-08-01&to=2026-08-04Security Disclosure
If you discover a security vulnerability, see Security Disclosure.