HIPAA-compliant data connectivity for healthcare
Under a signed BAA, health and life science entities can bring AI, integration, and data movement use cases involving ePHI to production while remaining HIPAA compliant.
What HIPAA compliance means at the data layer
HIPAA's Security Rule requires controls at the data layer: row- and column-level access controls, audit logging of ePHI access, encryption in transit and at rest, and documented data flows.
Whether you run Connect AI, Sync (On-Prem), or Arc (On-Prem), CData signs the BAA, designates a HIPAA Security and Privacy Officer, and documents the ePHI data flows your compliance team references in audits. Each product applies these safeguards in the way that fits how it moves data.
Encryption in transit and at rest
Role-based access controls (RBAC)
Documented ePHI data flows
Signed Business Associate Agreement
Audit logging of ePHI access
Choose the CData product for your HIPAA workload
Connect AI, Sync (On-Prem), and Arc (On-Prem) are available under CData's BAA for eligible use cases. Sync and Arc are deployed and operated in your own environment.
Governed, real-time data access for AI assistants, agents, and analytics across hundreds of healthcare and enterprise sources.
Connect AI and HIPAAData replication and pipelines between EHRs, databases, and warehouses, run on infrastructure you control, with encryption in transit, PII masking, and access logging.
Sync and HIPAASecure file transfer and healthcare EDI, including X12 HIPAA and HL7, run on infrastructure you control, with encryption, audit trails, and managed authentication.
Arc and HIPAADeploy AI applications and agents with Connect AI
Connect AI enforces HIPAA's technical safeguards at the platform level, so every new source you add is immediately governed by the same HIPAA-compliant policies.
IT teams can finally tame MCP sprawl by connecting AI tools, assistants, and workflows to a controlled data layer spanning real-time data sources like Salesforce, Veeva, and SAP.
Back-office teams gain real-time insights and automated actions across internal and on-premises R&D, clinical, and commercial systems—with the audit trail, lineage, and GxP documentation regulators expect.
AI architects can now connect CRM, support tickets, call recordings, and client profiles to a chosen AI tool, enabling client success teams to stay ahead of every challenge and upgrade opportunity that comes their way.
Managed providers are deploying EHR- and ERP-connected assistants, insights engines, and automated workflows across their networks, accessible directly within the Microsoft CoPilot, Claude, Azure OpenAI, and Gemini tools they already use.
Connect the systems healthcare runs on
Connect AI ships with maintained connectors across the clinical, enterprise, and data-platform systems that hold ePHI—each governed by the same platform-level safeguards under your BAA.
Hundreds of connectors, and growing—browse the full library.
HIPAA-eligible data pipelines, deployed in your environment
Sync replicates and transforms ePHI between the systems you already run, from software you deploy and operate yourself, on-premises or in your own cloud account.
How Sync supports HIPAA workloads
- Encryption in transit for data moving between sources, Sync, and destinations.
- PII masking and hashing applied in the pipeline, before data reaches downstream platforms.
- Granular access logging of user and job activity for audit review.
- Access controls including role-based access and single sign-on to limit who can build and run pipelines that touch ePHI.
- Hundreds of connectors to replicate from EHR, ERP, CRM, and database sources into the warehouse or database you choose.
Your environment, your controls
- You deploy and operate Sync on infrastructure you manage, so you set the network boundaries, host hardening, and server-level encryption.
- You choose and secure the source and destination systems. ePHI at rest is protected by those systems' controls.
- You configure user access, retain Sync's logs, and review them as your HIPAA policies require.
- You decide which pipelines carry ePHI, and keep them within the eligible use cases.
HIPAA-eligible file transfer and EDI, deployed in your environment
Arc exchanges X12 HIPAA, HL7, and other healthcare files with your trading partners, from software you deploy and operate yourself.
How Arc supports HIPAA workloads
- Encryption in transit over AS2, AS4, SFTP, and FTPS/TLS.
- Encryption at rest for files, with built-in Open PGP and AES support.
- Audit trails of user events, file activity, and transactions, searchable from a central admin API.
- Authentication and authorization against LDAP and Active Directory, with services restricted to specific users and groups.
- Healthcare EDI for X12 HIPAA transactions and HL7/FHIR, with delivery receipts that prove what was exchanged.
Your environment, your controls
- You deploy and operate Arc on infrastructure you manage, so you set the network boundaries, host hardening, and storage controls.
- You generate and safeguard the encryption keys and certificates Arc uses.
- You manage trading-partner agreements, and the ePHI in the files you exchange stays under your retention and disposal policies.
- You configure user access, retain Arc's logs, and review them as your HIPAA policies require.
Peace of mind for every team that touches the data
IT and security
CData's HIPAA-eligible products provide the safeguards HIPAA's business associate requirements call for — encryption, access controls, and audit logging, complete with ePHI flow maps and a signed BAA.
Operations and delivery
Healthcare data doesn't have to stay siloed to stay compliant. Clinical, operations, and analytics teams can put ePHI to work across EHRs, payer platforms, warehouses, and enterprise apps—through AI, data pipelines, or EDI.
Developers
Pre-built connectors in Connect AI and Sync, and built-in EDI, HL7, and MFT capabilities in Arc, let IT developers build ePHI connections without starting from scratch.
Move your HIPAA-regulated use cases from pilot to production
Need a BAA?
Tell us a bit about your organization and our legal team will follow up with a BAA for eligible CData Connect AI, Sync (On-Prem), and Arc (On-Prem) use cases. You can also contact your CData sales rep.