Built for the HIPAA Security Rule
MEDBlock implements the administrative, physical, and technical safeguards required by the HIPAA Security Rule. PHI is encrypted at rest and in transit, access is role-based and least-privilege, and every consent, read, and disclosure is logged. Log integrity is anchored to the blockchain, so tampering is detectable after the fact.
How MEDBlock keeps PHI off the ledger
Blockchain is powerful for integrity and consent but PHI never belongs on a public ledger. MEDBlock stores PHI in HIPAA-eligible encrypted systems and anchors only cryptographic hashes, consent events, and payment metadata on the XRP Ledger, verified through Chainlink oracles.
What you get
- Encrypted PHI storage with AES-256 at rest and TLS 1.2+ in transit.
- Role-based access control and SSO / SAML integration.
- Immutable audit trail anchored on chain.
- Signed Business Associate Agreement (BAA) with every customer.
- FHIR R4 and HL7 v2 integration with major EHRs.
- Faster provider and insurer payouts through MEDBlock Pay.
Frequently asked questions
What is a HIPAA compliant data platform?
A HIPAA compliant data platform stores, processes, and transmits protected health information (PHI) under the safeguards required by the HIPAA Privacy, Security, and Breach Notification Rules. It provides encryption in transit and at rest, role-based access control, audit logging, business associate agreements, and documented incident response.
Is MEDBlock HIPAA compliant?
MEDBlock is architected to meet HIPAA Security Rule safeguards. PHI is stored in encrypted, access-controlled systems; blockchain records only hashes, consent events, and audit trails. We sign a Business Associate Agreement (BAA) with covered entities and business associates.
How does blockchain fit into HIPAA compliance?
Blockchain does not replace HIPAA controls it strengthens them. PHI stays off-chain in encrypted stores; the chain provides a tamper-evident record of consent, access, and disclosures. This supports the HIPAA audit control and integrity requirements without exposing PHI on a public ledger.
Where is patient data stored?
PHI is stored in HIPAA-eligible cloud infrastructure with encryption at rest (AES-256) and in transit (TLS 1.2+). Only cryptographic hashes and event metadata are anchored on the XRP Ledger through MEDBlock Pay and verified via Chainlink oracles.
Do you sign a Business Associate Agreement (BAA)?
Yes. MEDBlock executes a Business Associate Agreement with every covered entity or business associate customer before PHI is exchanged.
What audit logs does the platform produce?
Every read, write, export, and consent change is logged with user, timestamp, resource, and action. Log integrity is anchored to the blockchain so tampering is detectable after the fact.
Which standards does MEDBlock align with beyond HIPAA?
The platform aligns with HITRUST CSF control families, NIST 800-53 moderate baseline, SOC 2 Trust Services Criteria, and for international deployments GDPR, PIPEDA, and PHIPA.
Can MEDBlock integrate with existing EHR systems?
Yes. MEDBlock supports HL7 v2, FHIR R4, and CDA integrations with major EHRs and can operate as a data layer alongside Epic, Cerner (Oracle Health), Meditech, and Athenahealth deployments.