← BackSecurity & HIPAA Compliance
Last updated: April 6, 2026
RFoodX is a HIPAA-compliant platform built for medically-tailored meal delivery operations. We handle Protected Health Information (PHI) for Medi-Cal members and take our obligation to protect that data seriously. This page describes the technical, administrative, and physical safeguards we maintain.
HIPAA Compliance
RFoodX is designed to meet the requirements of the HIPAA Security Rule (45 CFR Part 164, Subpart C) and the HIPAA Privacy Rule (45 CFR Part 164, Subpart E). Our compliance program includes:
- Formal risk assessments conducted regularly
- Business Associate Agreements (BAAs) with all vendors that process PHI
- Workforce training on HIPAA obligations and PHI handling
- Documented policies and procedures for PHI access, use, and disclosure
- Incident response and breach notification procedures
Authentication & Access Control
We enforce strict access controls to ensure only authorized personnel can access PHI:
- Multi-factor authentication (MFA) required for administrative and privileged accounts using TOTP-based authenticators
- Role-based access control (RBAC) with six defined roles: staff, outreach, registered dietitian, submission, billing, and manager
- Section-level permissions restrict each user to only the data and features their role requires (minimum necessary standard)
- Automatic session timeout after 6 hours of inactivity with a 5-minute warning
- Per-session HIPAA acknowledgment required before accessing any protected data
- Password requirements: minimum 12 characters with uppercase, lowercase, numbers, and special characters
Data Encryption
- In transit: All data is encrypted using TLS 1.2+ (HTTPS). HSTS headers enforce secure connections.
- At rest: Database encryption using AES-256 provided by our infrastructure provider (Supabase/AWS).
- Backups: Automated encrypted backups with point-in-time recovery.
Database Security
- Row-Level Security (RLS) enabled on all tables containing PHI, restricting access to authenticated users only
- No anonymous access to any table containing member data, health information, or support records
- Service-role separation: Server-side operations use a restricted service role; browser clients use a limited anonymous key with RLS enforcement
Audit Trail
All access to PHI is logged in an immutable audit trail. Audit records include:
- User identity (who accessed the data)
- Action performed (view, create, update, delete)
- Resource accessed (which record or data type)
- Timestamp
- HIPAA session acknowledgment records
Audit logs are retained for a minimum of 6 years as required by HIPAA.
Infrastructure
- Hosting: Vercel (SOC 2 Type II certified)
- Database: Supabase (SOC 2 Type II, HIPAA-eligible with BAA)
- CDN & Edge: Vercel Edge Network with DDoS protection
- Security headers: X-Frame-Options, X-Content-Type-Options, Strict-Transport-Security, Referrer-Policy, and Content-Security-Policy configured on all routes
Application Security
- Webhook authentication: All inbound webhooks require cryptographic signature verification or bearer token authentication
- Input validation: All user inputs are sanitized to prevent injection attacks (SQL, XSS, command injection)
- CSRF protection: Built into the framework (Next.js) with SameSite cookie attributes
- Dependency management: Regular vulnerability scanning of all dependencies with automated alerts
- AI/LLM security: PHI guard rails prevent storage of member-identifiable information in AI learning systems. Data sent to AI services is governed by Business Associate Agreements.
Incident Response
In the event of a security incident or potential breach, RFoodX follows a documented incident response plan that includes:
- Immediate containment and investigation
- Assessment of PHI exposure
- Notification to affected individuals within 60 days as required by the HIPAA Breach Notification Rule
- Notification to the HHS Office for Civil Rights
- Remediation and post-incident review
Regular Assessments
We conduct regular security assessments including:
- Automated security scanning (OWASP Top 10, dependency vulnerabilities, secrets detection)
- Access control reviews
- PHI data flow mapping
- Vendor security assessment reviews
Responsible Disclosure
If you discover a security vulnerability in our platform, please report it responsibly by contacting us at security@rfoodx.com. We take all reports seriously and will respond within 48 hours.
Contact
For security inquiries or to request documentation of our HIPAA compliance program, contact: