HIPAA

FAQs

• What is HIPAA?

  HIPAA stands for the Health Insurance Portability and Accountability Act, a U.S. law enacted in 1996 to protect the privacy and security of Protected Health Information (PHI). HIPAA includes rules for privacy, security, breach notification, and more, with a focus on safeguarding electronic PHI (ePHI) through administrative, physical, and technical safeguards.

• Who does HIPAA apply to?

  HIPAA applies to two main groups:

  • Covered Entities: such as hospitals, clinics, and health insurance providers that create or manage PHI;

  • Business Associates: third parties (like cloud service providers) that process PHI on behalf of Covered Entities. When customers use Zilliz Cloud to process PHI, Zilliz acts as a Business Associate.

• What is a BAA?

  A Business Associate Agreement (BAA) is a legally required contract under HIPAA between a Covered Entity and its Business Associate. It outlines responsibilities for handling PHI, data protection, breach notification, and compliance obligations.

• Can my organization enter into a BAA with Zilliz?

  Yes. Zilliz is willing to sign a standard BAA with eligible customers who plan to process PHI using our platform. To request a BAA, please contact us.

• Is Zilliz Cloud HIPAA compliant?

  It is important to note that there is no certification recognized by the US Department of Health and Human Services (HHS) for HIPAA compliance and that complying with HIPAA is a shared responsibility between the customer and Zilliz. Zilliz Cloud implements controls that align with the HIPAA Security Rule but customers are ultimately responsible for evaluating their own HIPAA compliance.

• How does Zilliz ensure HIPAA compliance and protect healthcare data?

  Zilliz Cloud implements a wide range of security controls to support HIPAA compliance:

  • AES-256 encryption at rest;
  • TLS 1.2+ encryption in transit;
  • Granular access control and least privilege;
  • Multi-factor authentication (MFA);
  • Detailed audit logging;
  • Tenant-level data isolation.

  These safeguards align with HIPAA’s Technical Safeguard requirements.

• Has Zilliz Cloud been examined for HIPAA?

  Zilliz has completed an Independent Practitioner's Assessment evaluating its alignment with the requirements of the HIPAA Security Rule and the Breach Notification Rule under the Health Information Technology for Economic and Clinical Health Act (HITECH).
  The assessment was conducted by an accredited third-party firm. The resulting report confirms that Zilliz's security and privacy controls are suitably designed and effectively implemented to meet the applicable implementation specifications outlined in 45 CFR Part 164. A summary of the assessment is available to qualified customers under NDA. Please contact us.