Security & compliance
Security at Athon
Behavioral health data is some of the most sensitive in healthcare. Here is how Athon protects it, measured against HIPAA and 42 CFR Part 2, with an honest status for every control. Evidence for each item is available on request.
01
The short version
Your own environment
A dedicated cloud account, network, database and encryption keys that hold only your data, in the US.
Closed by default
New data stays hidden from every user until it is classified. You approve each user's role, and permissions are enforced in the database, not just on screen.
Part 2 protected
Substance use disorder records under 42 CFR Part 2 are visible only to roles you clear, and every view is flagged.
AI inside the boundary
AI requests go only to model vendors that have signed a BAA with Athon. Answers use only the data the asking user is allowed to see.
Detailed audit trail
Sign-ins, questions, exports and record views, each with user, time and IP address. Administration actions kept 6 years.
Read-only EHR access
Athon reads your EHR through dedicated, revocable credentials, separate from any staff login, over an encrypted connection.
02
How data flows
Your EHR and other systems
Read-only access with dedicated credentials. Encrypted, and never open to the public internet.
Your Athon environment
Hosted in the US on private servers, with an encrypted database, locked backups and tamper-proof logs. AI through BAA-covered model vendors only.
Your staff
Sign in with their work accounts, under your own multi-factor authentication. Encrypted connections only.
03
Status at a glance
Live runs for Athon clients today. Supported is part of every deployment and set up for you before any of your data reaches Athon.
Access control
Users join by invitation only, each with a role you approve. Permissions are enforced in the database. New data stays hidden until classified.
Audit trail
A record of user activity the application cannot alter, including refused access attempts. Part 2 access is flagged. Your compliance team can export it.
Client separation
Each client has its own copy of the application and its own database. Neither can serve another client's data.
Part 2 data
Visible only to roles cleared to see it, enforced in the database. Every access is flagged in the audit log.
Privacy in operations
Error reports exclude patient and user details. AI conversation logs are deleted after 90 days. The emergency access account is off by default, and every use is logged.
AI models
Only model vendors that have signed a BAA with Athon.
Security policies
A written policy set covering security, access, change, incident response, continuity, vendors, retention and disposal, encryption, logging, devices, training, vulnerabilities and privacy.
Single sign-on
Only your organization's accounts; guest and personal accounts are refused. Sessions end after 15 minutes idle.
EHR connections
Read-only, through dedicated credentials you can revoke. Each new EHR is connected and reviewed with you during onboarding.
Dedicated cloud environment
Private network with no direct server logins, encryption throughout, threat detection, administration logs kept 6 years on tamper-proof storage, continuous backups.
Part 2 clearance by you
Part 2 data is off for every role, including administrators, until you turn it on. This applies to screens and AI answers.
Athon staff access
Single sign-on with multi-factor authentication; no long-lived access keys.
04
HIPAA safeguards
Athon signs a Business Associate Agreement with every client. We map every Security Rule standard to what we do, its status and the evidence we can show.
Administrative safeguards
164.308- Invitation-only access with client-approved roles; Athon staff access limited to those supporting you and removed the day they leave
- HIPAA and security training at hire and yearly, with MFA on every staff account
- BAAs with every client and every vendor that could receive client data
- A named Security Officer and Privacy Officer
- Continuous backups kept 35 days: at most 5 minutes of data loss and recovery within 4 hours, proven by quarterly restore tests
- A written risk analysis for every system that touches client data, reviewed yearly
- A written incident response plan with severity levels and a client notification path
Physical safeguards
164.310- Athon staff may not download client data to laptops
- The database accepts connections only from the application server
- Client data lives only on encrypted storage in US data centers, under your cloud provider's physical security controls
- If the partnership ends, your data is fully wiped
Technical safeguards
164.312- Every person has their own account; no shared logins
- An emergency access account, off by default, with an audit record of every use
- Every sign-in, question, export and record view logged; the application cannot change or delete audit records
- Sessions end after 15 minutes idle and 12 hours in total
- Sign-in through your identity provider, so your MFA and Conditional Access apply
- Encryption at rest with managed keys rotated yearly, and TLS 1.2 or higher on every connection
Policies and breach notification
164.316, 164.410- A written policy set, kept 6 years and reviewed yearly
- Notice of any suspected breach of your data without unreasonable delay, within the period set in our BAA
05
42 CFR Part 2 and AI
Restricted and flagged
Substance use disorder data, and anything derived from it, is available only to cleared clinical and administrator roles. Every audit event that touches Part 2 data is flagged for compliance review.
AI within the user's access
AI answers use only the data the asking user is allowed to see, and requests go only to model vendors with a signed BAA.
Qualified Service Organization
Athon acts as your Qualified Service Organization under 42 CFR Part 2, and our agreement covers Part 2 alongside HIPAA. Athon uses Part 2 data only to provide services to you and does not redisclose it.
You decide who is cleared
Part 2 access is set per role and is off for every role until you turn it on. Uncleared users, including administrators, never see Part 2 data or metrics, in screens or AI answers.
06
Where Athon runs
Sign-in, approved roles, Part 2 restrictions, the audit log and read-only EHR access work the same wherever Athon runs. Offered means available on request and scoped with your IT team.
Recommended
Dedicated Athon-run environment
A cloud account and network that hold only your data, built from our standard HIPAA template. Strongest isolation, least work for your IT team, fastest to start.
AWS, Azure or Google Cloud
In your own cloud
Athon deploys into a cloud account you own. Your data never leaves your boundary, and named Athon engineers work through your cloud's own access controls.
On-premises
On your own servers
Athon runs on a server in your data center, next to your other systems. You run the server and network; Athon runs and updates the application.
You decide who is cleared
Part 2 access is set per role and is off for every role until you turn it on. Uncleared users, including administrators, never see Part 2 data or metrics, in screens or AI answers.
