How IMP protects agency, interpreter, client, and consumer data — stated plainly. Each control is labeled by where it comes from: engineered into IMP, inherited from our audited infrastructure providers, or part of our active compliance program. We would rather show you an honest map than a wall of green checkmarks.
Prepared July 2026 · Frederick Interpreting Agency / IMP
Built into IMPInherited from audited infrastructureIn progress — compliance program
"Inherited" controls run on SOC 2–audited managed cloud platforms and are configured and verified by IMP. Our subprocessor list is provided under NDA or BAA. HIPAA citations reference 45 CFR Part 164.
Scope of HIPAA-covered services
IMP's HIPAA program covers the scheduling core: appointments and records, the agency/interpreter/client portals, and human-interpreter VRI and OPI calling. For covered customers, IMP executes a Business Associate Agreement and maintains corresponding agreements with the infrastructure subprocessors that store or transmit PHI.
Explicitly outside PHI scope today: AI real-time translation and AI document intake. These features must not be used with protected health information until their vendor agreement chain is complete (planned Phase 2). HIPAA-tier customers receive this boundary in writing, and it is enforced in onboarding guidance.
Access Management & Tenant Isolation
164.308(a)(4) · 164.312(a)Built into IMP
Information is available only to authorized users
Row-Level Security enforced in the database itself: every table carries per-tenant policies, so isolation holds even if application code errs — a stronger guarantee than application-layer role checks alone.
Role-based portals (agency admin, interpreter, client) expose only the records each role is entitled to; privileged actions (e.g., creating jobs) are gated to agency administrators at the policy layer.
Client-portal users are scoped to their own organization's records; interpreters see only work offered to or assigned to them.
Managed authentication with hashed credentials and token-based sessions; sessions are isolated per agency domain.
Encryption & Decryption
164.312(a)(2)(iv) · 164.312(e)Inherited
Data encrypted in transit and at rest
All traffic is HTTPS/TLS; plaintext transport is not accepted anywhere in the platform.
Databases and their backups are encrypted at rest (AES-256, volume-level) on audited cloud infrastructure.
Live call media (VRI/OPI) is carried over encrypted WebRTC transport end to end through the media infrastructure.
Key Management
164.312(e)(2)Inherited
Encryption keys protected and rotated
Encryption keys are held in the cloud provider's key-management service, backed by hardware security modules; master keys are never stored in plaintext on disk.
Access to key services follows least privilege; application secrets are stored in managed secret stores, never in source code.
Logging & Audit Controls
164.312(b)Built into IMP
Activity recorded and reviewable
Application activity log records member actions across the portals.
Call sessions are recorded as structured events (participants, timing, outcome) for every VRI/OPI session.
Every outbound notification is written to an audit log with status and timestamp at send time.
Operational errors automatically create tickets with severity and context, and alert the operator by email — failures are visible, not silent.
Authentication events, including failed logins, are logged by the identity platform.
Formal log-retention schedule and a customer log-request procedure are being documented as part of the compliance program (see Administrative Safeguards).
Monitoring
164.308(a)(1)(ii)(D)Inherited + built
Systems watched for failure and misuse
Infrastructure monitoring, DDoS mitigation, and network controls are provided and operated by the underlying platforms.
IMP adds its own health monitoring with automated backstops: platform faults surface as alerts and tickets to the operator.
Database access from the application passes exclusively through the policy-enforced API layer; direct database exposure to the internet is not part of the architecture.
Today: automated error and incident capture with operator alerting is live; incidents are tracked as tickets with severity, context, and resolution history.
In progress: a written incident-response procedure, incident register, and breach-notification workflow that meets the Breach Notification Rule's timelines.
Backup & Recovery
164.308(a)(7)Inherited
Data survives failure
Automated, encrypted database backups run on the managed platform.
In progress: a written contingency and disaster-recovery runbook with recovery-time objectives.
Business Associate Agreements
164.308(b) · 164.314(a)In progress
The agreement chain that makes compliance real
IMP executes BAAs with covered customers (agencies serving healthcare clients) as part of HIPAA-tier onboarding.
Subprocessor BAAs with the infrastructure that stores PHI (database platform) and transmits call media (calling platform) are being executed now on their HIPAA-eligible tiers.
Notification email is engineered to be PHI-free by policy: messages carry job references and portal links, with details living behind authenticated portal access.
Payment processing carries billing data only; clinical detail is kept out of invoices by design.
Administrative Safeguards
164.308In progress
The people-and-paper half of HIPAA
Designated Security Officer; written risk analysis; security policies and procedures; workforce training; sanction policy; periodic review.
These are being formalized as a documented compliance program alongside the technical controls above.
We list this honestly as in progress. Vendors who claim complete HIPAA compliance without an administrative program are describing their servers, not their obligations.