Identity & Authentication
Institutional accounts, strong password controls, administrator separation, session handling and optional integration with organization-selected identity services.
Security & Compliance
Security is architecture—not a checkbox.
Umoja is designed to support healthcare organizations implementing strong privacy, access, audit, infrastructure and operational controls. Final compliance depends on the complete deployment and operating environment.
HIPAA-aligned safeguardsSOC 2-oriented controlsRBACAuditabilityTLSCustomer-controlled hosting
A secure EHR is the combination of application controls, infrastructure, identity, policies, monitoring, contractual safeguards and human operating procedures. No software product can make an organization compliant by itself.
Role-Based Access
Control access by role, facility, unit, function and context so users receive only the permissions required for their work.
Audit & Traceability
Capture sensitive actions and operational events so organizations can investigate access, change and workflow history.
Encryption in Transit
HTTPS/TLS at the edge with organization-selected certificate, reverse-proxy and network architecture.
Offline Protection
Encrypted offline-capable workflows with online reauthentication required before synchronization where configured.
Container & Service Isolation
Dockerized services, non-root/read-only patterns where configured, private networking, secrets handling and health checks.
Database Controls
PostgreSQL access restricted to application/service context with customer-defined backup, retention and recovery processes.
Environment Separation
Training, demonstration, staging and production environments should remain logically and operationally separated.
Operational Security
Rate limiting, monitoring, incident response, vulnerability management and change control must be part of the deployment program.
HIPAA
Designed for HIPAA-regulated deployment programs.
Umoja can provide technical capabilities that support HIPAA Security Rule objectives, but a HIPAA-regulated deployment still requires the covered entity or business associate to implement appropriate administrative, physical and technical safeguards.
Do not describe the product as “HIPAA certified.” HIPAA does not operate as a simple software certification badge. Compliance depends on the organization and complete implementation.
| Control area | How a deployment can address it |
|---|---|
| Access control | RBAC, facility context, account lifecycle, least privilege and identity configuration |
| Audit controls | Application audit events, infrastructure logs and organization-defined monitoring |
| Transmission security | TLS/HTTPS and secure integration channels |
| Integrity | Controlled application workflows, database permissions, change management and backups |
| Contingency | Customer-defined backup, disaster recovery, restore testing and continuity procedures |
| Risk management | Formal risk analysis, policies, training, vendor agreements and remediation processes |
SOC 2
Build toward a SOC 2-ready operating environment.
SOC 2 readiness involves more than application code. It requires documented controls, operating evidence and—when pursued—an independent examination against the applicable Trust Services Criteria.
- Security governance and control ownership
- Access provisioning, review and termination
- Change management and release controls
- Logging, monitoring and incident response
- Vendor and infrastructure risk management
- Backup, continuity and availability controls
- Evidence collection and periodic control testing
Compliance-ready means the architecture can support the program. It does not mean the program has already been audited.Umoja security positioning
Deployment responsibility
The customer chooses the hosting model—and therefore much of the control environment.
Infrastructure
Cloud/VPS/on-prem selection, region, private networking, firewalling, secrets, patching, backups and observability.
Organization
Policies, account administration, workforce training, risk analysis, incident response, device security and business continuity.
Implementation
Configuration, interface security, testing, migration, access design, go-live readiness and operational handover.
Regulatory obligations vary by jurisdiction and organization. Legal and compliance review should be part of every production deployment.
Design the security program with the deployment—not after it.
Tell us your regulatory environment, infrastructure constraints and security requirements so they can be addressed during implementation planning.