Dezy It uses enterprise-grade encryption to protect all PHI and PII. Data in transit is secured with TLS 1.3, and data at rest is encrypted using AES-256. Access is controlled through multi-factor authentication, role-based permissions, and centralized key management via Azure Key Vault.

Yes. Dezy It is fully HIPAA compliant and enforces strict safeguards for Protected Health Information (PHI). We follow HIPAA Privacy, Security, and Breach Notification Rules, including access controls, audit trails, retention policies, and breach-response procedures.

Dezy It aligns with major US and international security standards, including:

• HIPAA (healthcare compliance)

• SOC 2 Type II (security and operational controls)

• ISO 27001 (information security management)

• ISO 9001 (quality management)

• PCI-DSS (secure payment processing via Stripe)

These certifications ensure strong security controls across infrastructure, workflows, and vendor systems.

No. Dezy It does not store clinical patient records. Those remain within your clinic’s EHR.

We only store:

• Call summaries (anonymized, 90 days)

• Call logs (encrypted, 90 days)

• Administrative and configuration data

All data is handled according to strict HIPAA retention and deletion guidelines.

We use Microsoft Defender for Cloud and Azure Security Center for continuous monitoring, anomaly detection, and real-time alerting.

Our incident response plan covers:

1. Detection

2. Containment

3. Investigation

4. Mitigation

5. HIPAA Breach Notification within 60 days (if applicable)

6. Recovery and post-incident analysis

Access is governed by Role-Based Access Control (RBAC) with least-privilege enforcement. Multi-Factor Authentication (MFA) is required for all admin accounts.

We also enforce:

• Automated user provisioning and deprovisioning

• Audited access logs

• Masking of sensitive identifiers

• Strict vendor access limitations