Tenant isolation
Hospital-owned reads and writes are scoped server-side. The blueprint requires tenant-scoped access on every tenant-owned read/write.
SECURITY
Security is a set of enforceable boundaries, not a marketing badge.
EPIOVIA's public site documents the security model from the blueprint and production source. It does not claim certifications that have not been independently established.
CONTROL SURFACE
Every section below answers one practical security question.
The controls below apply to the public website itself where relevant, while the clinical application has a deeper tenant and authorization model.
Authorization
System roles and capabilities are separate concepts. Sensitive operations require the relevant capability rather than relying on a title alone.
Auditability
Clinical, financial, permission, document-access and security changes need attributable records rather than silent overwrites.
Private PHI storage
Staff and patient documents are private storage assets, not public web files.
Session & CSRF protection
The public site uses secure session cookies, CSRF tokens and strict server-side validation.
Browser hardening
The public site uses CSP, anti-framing policy, MIME sniffing protection, restrictive referrer policy and permissions policy.
Spam resistance
Contact submissions use CSRF, honeypot, minimum completion time, IP bucket rate limiting, message length limits and URL heuristics.
Honest certification language
Implementation controls are described without claiming HIPAA, ISO 27001, SOC 2, NABH or other certification that has not been independently established.
PUBLIC WEBSITE HARDENING
No analytics SDK, no third-party JS, no public uploads.
This public site deliberately keeps the attack surface small. JavaScript is same-origin, forms submit only to this origin, content is CSP constrained, and the public contact workflow is protected against common automated abuse.
CSPSelf-only scripts and styles
Frame policyPrevent clickjacking
Spam controlCSRF + honeypot + rate limit
HeadersNosniff · Referrer · Permissions
WHAT IS NOT CLAIMED
Implementation is not certification.
EPIOVIA does not advertise HIPAA, ISO 27001, SOC 2, GDPR, NABH or other formal certification on this public site unless the organization can evidence it independently. The blueprint also says that building supporting features does not itself make EPIOVIA certified.