HIPAA Compliance
Last reviewed: July 1, 2026 · OnePath Health, Inc.
OnePath's Role as a Business Associate
OnePath Health, Inc. operates as a HIPAA Business Associate (45 CFR §160.103) when it receives, maintains, or transmits Protected Health Information ("PHI") on behalf of Covered Entities and Business Associates using OnePath Connect. All production API Partners must execute a Business Associate Agreement ("BAA") with OnePath before any PHI is exchanged. OnePath does not use or disclose PHI for any purpose other than those permitted by the applicable BAA and HIPAA regulations.
What PHI OnePath Receives
Through the OnePath Connect API, Partners may submit:
- FHIR Observations — Lab values coded to LOINC with numeric values, units, and effective dates
- FHIR Conditions — Clinical diagnoses coded to SNOMED CT with clinical status
- Clinical Documents — Lab reports and health documents in PDF or image format
- Patient Demographics — Name, date of birth, and contact identifiers for record creation
OnePath stores only a cryptographic hash (SHA-256) of the Partner's external patient identifier — never the raw identifier itself. PHI is scoped to each Partner's isolated FHIR namespace and is never shared across Partner applications.
Consent and Authorization
The API enforces a dual-layer consent model for every PHI-returning request:
- A platform-level consent record created when a patient is onboarded. Revocation immediately blocks all subsequent PHI access, regardless of a valid consent JWT.
- Each PHI-returning call requires a short-lived, per-patient consent assertion JWT signed by the Partner using their RSA-2048 private key. JTI values are single-use to prevent replay.
Minimum Necessary Standard
Each consent assertion JWT specifies the scopes required for the specific API operation (e.g., labs.read, chat.user). Partners are expected to request only the scopes required for each specific use case.
HIPAA Safeguards
Administrative, technical, and physical.
Administrative Safeguards
- Designated Security and Privacy Officers
- HIPAA training for all workforce members with PHI access
- Risk analysis and risk management program
- Vendor management and Business Associate Agreement program
- Workforce sanctions policy for security violations
Technical Safeguards
- Dual-layer auth: API key + RS256-signed per-patient consent JWT
- Per-partner FHIR data namespace isolation
- Encryption in transit (TLS 1.2+) and at rest (AES-256)
- Immutable audit log for every PHI-returning API call
- Automatic consent revocation propagation
- Single-use JWT IDs (replay attack prevention)
Physical Safeguards
- Microsoft Azure data centers with SOC 2 Type II and ISO 27001
- No on-premises PHI storage
- Media disposal procedures for any portable media
Breach Notification
In the event of a Security Incident constituting a Breach of Unsecured PHI under HIPAA (45 CFR §164.400 et seq.), OnePath will notify affected Partners without unreasonable delay and no later than sixty (60) calendar days from discovery. Partners must report suspected incidents to security@onepath.health promptly.
Audit Trail
OnePath maintains an immutable audit record for every PHI-returning API call capturing:
- Partner application identifier
- External patient identifier (SHA-256 hash only)
- API endpoint and timestamp
- JWT ID (jti) of the consent assertion used to authorize the request
- Response status
These records are append-only and cannot be modified or deleted. Audit log access may be made available to Partners on request.
Partner HIPAA Obligations
- Obtain valid patient authorization before submitting PHI to the API
- Maintain consent event records (timestamp, disclosure version, mechanism)
- Secure your RSA-2048 private key in an HSM or secrets manager in production
- Immediately honor patient consent revocation and purge locally cached PHI
- Report suspected security incidents to OnePath and HHS within HIPAA timelines
- Ensure downstream products and disclosures comply with applicable health privacy law
Questions About HIPAA Compliance
Contact our Privacy and Security team at privacy@onepath.health or security@onepath.health.
Ready to execute a BAA and begin integration?
Request Partner Access