HIPAA

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) regulates the protection of the privacy and security of health information. Zilliz is HIPAA-ready, enabling covered entities and their associates to use our secure cloud database to process, maintain, and store protected health information (PHI).

FAQs

What is HIPAA?
HIPAA stands for the Health Insurance Portability and Accountability Act, a U.S. law enacted in 1996 to protect the privacy and security of Protected Health Information (PHI). HIPAA includes rules for privacy, security, breach notification, and more, with a focus on safeguarding electronic PHI (ePHI) through administrative, physical, and technical safeguards.
Who does HIPAA apply to?
HIPAA applies to two main groups:
- Covered Entities: such as hospitals, clinics, and health insurance providers that create or manage PHI;
- Business Associates: third parties (like cloud service providers) that process PHI on behalf of Covered Entities. When customers use Zilliz Cloud to process PHI, Zilliz acts as a Business Associate.
What is a BAA?
A Business Associate Agreement (BAA) is a legally required contract under HIPAA between a Covered Entity and its Business Associate. It outlines responsibilities for handling PHI, data protection, breach notification, and compliance obligations.
Can my organization enter into a BAA with Zilliz?
Yes. Zilliz is willing to sign a standard BAA with eligible customers who plan to process PHI using our platform. To request a BAA, please
Is Zilliz Cloud HIPAA compliant?
It is important to note that there is no certification recognized by the US Department of Health and Human Services (HHS) for HIPAA compliance and that complying with HIPAA is a shared responsibility between the customer and Zilliz. Zilliz Cloud implements controls that align with the HIPAA Security Rule but customers are ultimately responsible for evaluating their own HIPAA compliance.
How does Zilliz ensure HIPAA compliance and protect healthcare data?
Zilliz Cloud implements a wide range of security controls to support HIPAA compliance:
- AES-256 encryption at rest;
- TLS 1.2+ encryption in transit;
- Granular access control and least privilege;
- Multi-factor authentication (MFA);
- Detailed audit logging;
- Tenant-level data isolation.
These safeguards align with HIPAA’s Technical Safeguard requirements.
Has Zilliz Cloud been examined for HIPAA?
Zilliz is currently undergoing an Independent Practitioner’s Assessment to evaluate its alignment with the requirements of the HIPAA Security Rule and the Breach Notification Rule under the Health Information Technology for Economic and Clinical Health Act (HITECH). The assessment is being conducted by an accredited third-party firm and is expected to be completed by September 2025. The resulting report will evaluate whether Zilliz’s security and privacy controls are suitably designed and effectively implemented to meet the applicable implementation specifications outlined in 45 CFR Part 164. Upon completion, a summary of the assessment will be available to qualified customers under NDA. Please .

HIPAA

AI Assistant