HIPAA
Full HIPAA Privacy and Security Rule compliance. PHI handled exclusively within audited environments. BAA available to all customers and trading partners on request.
PHI handling is the foundation of our product, not an afterthought. Gabeo operates under a strict compliance framework, signs BAAs on day one, and ships every output with a defensible audit trail.
Full HIPAA Privacy and Security Rule compliance. PHI handled exclusively within audited environments. BAA available to all customers and trading partners on request.
Type I attestation complete. Type II observation window underway, with a Big-Four auditor expected to issue the report in Q3 2026. Bridge letter available on request.
Workloads run on Google Cloud's HIPAA-eligible services. Healthcare API, BigQuery, and Cloud Storage with CMEK. Multi-region disaster recovery.
HITRUST CSF certification is on the 2027 roadmap. Customers requiring HITRUST-aligned controls today can review our mapping under NDA.
Gabeo only ingests the claim and contract fields needed to perform attribution. We do not request, store, or process PHI beyond what is strictly necessary. Member identifiers are pseudonymized at ingestion; de-identification is available on request.
Every customer is isolated in their own logical tenant with separate encryption keys, network policies, and access controls. There is no cross-tenant data flow at any layer of the stack.
Role-based access at the contract, line-of-business, and rule-set level. SSO via SAML or OIDC required for production access. MFA enforced for all human operators. Service-account access is short-lived and scoped to specific jobs.
Every action - rule edit, claim review, dispute, recoupment decision - is captured to an immutable audit log retained for seven years. Exportable in CSV or JSON, and available to your internal or external auditors on request.
We maintain a current list of subprocessors and the data each one handles. Material changes are communicated to customers at least 30 days in advance.
Documented 24/7 incident response with defined RPO/RTO. Notification within 24 hours of any confirmed security incident affecting customer data, in accordance with the BAA and applicable law.
The following documents are available under NDA to current and prospective customers. Reach out to contact@gabeo.ai with your request.
We respond to security and compliance reviews within 5 business days, including CAIQ, SIG, and customer-specific questionnaires.