Rondah AI | Trust Center
Rondah AI Compliance
Ensuring HIPAA Compliance and Data Security
See Compliance

Resources

Privacy Policy

Terms of Service

Subprocessors

Google Cloud

Cloud infrastructure, security, and data storage.

Microsoft Azure

Azure OpenAI Service - advanced generative models.

Kolla

Industry leading practice management system integration software.

NexHealth

Industry leading practice management system integration software.

Monitoring

Continuously monitored by Secureframe
View all

Compliance

HIPAA

Our HIPAA compliance continually monitored and validated by Secureframe. These assessments ensure that we meet HIPAA guidelines.

Monitoring

Change Management

Production Data Use is Restricted
Production data is not used in the development and testing environments, unless required for debugging customer issues.
Segregation of Environments
Development, staging, and production environments are segregated.
Baseline Configurations
Baseline configurations and codebases for production infrastructure, systems, and applications are securely managed.

Availability

Uptime and Availability Monitoring
System tools monitors for uptime and availability based on predetermined criteria.
Backup Restoration Testing
Backed-up data is restored to a non-production environment at least annually to validate the integrity of backups.

Organizational Management

Disciplinary Action
Personnel who violate information security policies are subject to disciplinary action and such disciplinary action is clearly documented in one or more policies.
Code of Conduct
A Code of Conduct outlines ethical expectations, behavior standards, and ramifications of noncompliance.
Cybersecurity Insurance
Cybersecurity insurance has been procured to help minimize the financial impact of cybersecurity loss events.
Internal Control Monitoring
A continuous monitoring solution monitors internal controls used in the achievement of service commitments and system requirements.
Information Security Program Review
Management is responsible for the design, implementation, and management of the organization’s security policies and procedures. The policies and procedures are reviewed by management at least annually.

Confidentiality

Data Classification Policy
A Data Classification Policy details the security and handling protocols for sensitive data.
Data Retention and Disposal Policy
A Data Retention and Disposal Policy specifies how customer data is to be retained and disposed of based on compliance requirements and contractual obligations.

Vulnerability Management

Third-Party Penetration Test
A 3rd party is engaged to conduct a network and application penetration test of the production environment at least annually. Critical and high-risk findings are tracked through resolution.

Incident Response

Tracking a Security Incident
Identified incidents are documented, tracked, and analyzed according to the Incident Response Plan.
Incident Response Plan
An Incident Response Plan outlines the process of identifying, prioritizing, communicating, assigning and tracking confirmed incidents through to resolution.

Risk Assessment

Risk Assessment
Formal risk assessments are performed, which includes the identification of relevant internal and external threats related to security, availability, confidentiality, and fraud, and an analysis of risks associated with those threats.

Network Security

Restricted Port Configurations
Configurations ensure available networking ports, protocols, services, and environments are restricted as necessary, including firewalls.

Access Security

Removal of Access
Upon termination or when internal personnel no longer require access, system access is removed, as applicable.

Communications

Communication of Security Commitments
Security commitments and expectations are communicated to both internal personnel and external users via the company's website.
Confidential Reporting Channel
A confidential reporting channel is made available to internal personnel and external parties to report security and other identified concerns.