HIPAA posture

Honest HIPAA snapshot

Rōvn is direct healthcare hiring infrastructure. We are building inside a HIPAA-eligible AWS foundation and are formalizing the operating-company program before connecting any production traffic to PHI. This page is the public version of our posture and is updated as evidence is added.

Rovn home Compliance status

Foundation

AWS BAA accepted on Rōvn's AWS account (559849758760, region us-east-2).
Private VPC with private subnets, controlled security groups, no direct public data plane exposure.
RDS PostgreSQL encrypted with a customer-managed KMS key (alias/rovn-phi), private, deletion protection enabled.
Evidence vault S3 bucket with public access blocked.
CloudTrail enabled account-wide; hardened trail bucket.
GuardDuty + Security Hub enabled. KMS key rotation enabled.
AWS Backup vault with completed point-in-time restore drill; restore evidence stored in the evidence vault.

Application-layer controls

Worker consent ledger. Packet release is gated on an explicit worker consent event.
Minimum-necessary disclosure. Organizations see only role-relevant fields.
Signed audit events. Ed25519-signed events for packet creation, consent grant, release, and revocation.
Primary-source verification against NPDB, Nursys e-Notify, OIG, SAM.
NPDB registration: DBID 399700000147857.

Program status

Control area	Status
AWS HIPAA-eligible foundation (BAA, KMS, VPC, audit, backup, restore drill)	In place
Application consent ledger and signed packet events	In place
Formal HIPAA Security Risk Assessment	In progress
Vendor BAA / DPA inventory and signed agreements	In progress
Formal HIPAA policies + workforce acknowledgements	In progress
Documented quarterly access review	In progress
Incident response tabletop and runbook	In progress
Production secrets fully in AWS Secrets Manager / SSM	In progress
Reviewed production application image pushed to ECR + ECS service enabled	Pending review
Production traffic connected to PHI backend	Pending
Independent third-party HIPAA assessment / SOC 2 readiness audit	Planned

What this means for organizations

Organizations can run workforce readiness workflows on Rovn today using source-receipted credential evidence. Rovn does not move PHI into production until the formal program above is complete. Customers contracting Rovn for production PHI workloads will sign a BAA with Rovn and may request the latest evidence binder under NDA.

What this means for workers

Your credential data is yours. Rovn does not release a packet to an organization without your explicit consent. Every release is logged and you can revoke release at any time.

Last updated 2026-04-25. We update this page when a status changes from in progress to in place.