HIPAA Privacy & Security Policy
Version: 1.0
Effective Date: July 25, 2026
Organization: SoftEd 21, S.L. (CTO Plus Team)
1. Purpose
SoftEd 21, S.L. (CTO Plus Team) is committed to protecting the confidentiality, integrity, and availability of Protected Health Information (PHI) and complying with the Health Insurance Portability and Accountability Act of 1996 (HIPAA), including the Privacy Rule, Security Rule, and Breach Notification Rule.
This policy establishes the administrative, physical, and technical safeguards used to protect PHI when developing, hosting, supporting, or maintaining software systems for healthcare organizations.
2. Scope
This policy applies to:
- All employees
- Contractors
- Consultants
- Temporary staff
- Third-party service providers
- All systems that create, receive, maintain, process, or transmit PHI
3. Definitions
Protected Health Information (PHI)
Any individually identifiable health information maintained or transmitted in any form.
Electronic Protected Health Information (ePHI)
PHI stored or transmitted electronically.
Workforce Member
Any employee, contractor, intern, or consultant with access to PHI.
4. Compliance
SoftEd 21, S.L. (CTO Plus Team) complies with:
- HIPAA Privacy Rule
- HIPAA Security Rule
- HIPAA Breach Notification Rule
- HITECH Act
- Applicable state privacy regulations
- Contractual Business Associate Agreements (BAAs)
5. Minimum Necessary Principle
Access to PHI is limited to the minimum amount necessary to perform assigned job responsibilities.
Employees may only access:
- Data required for assigned work
- Systems they are authorized to use
- Customer environments assigned to them
6. Administrative Safeguards
SoftEd 21, S.L. (CTO Plus Team) implements the following administrative safeguards.
6.1 Risk Assessment
Regular security risk assessments are performed to identify:
- Security vulnerabilities
- Operational risks
- Infrastructure weaknesses
- Third-party risks
Risks are documented and remediation plans tracked.
6.2 Workforce Training
Personnel receive training covering:
- HIPAA requirements
- Privacy obligations
- Secure software development
- Password management
- Social engineering awareness
- Phishing prevention
- Incident reporting
Training is provided upon hire and periodically thereafter.
6.3 Sanction Policy
Violations of this policy may result in:
- Retraining
- Suspension of access
- Disciplinary action
- Termination of employment or contract
6.4 Business Associate Agreements
SoftEd 21, S.L. (CTO Plus Team) enters into Business Associate Agreements when acting as a Business Associate before handling customer PHI.
7. Access Control
Access to systems containing PHI is controlled through:
- Unique user accounts
- Role-based access control (RBAC)
- Least privilege access
- Multi-factor authentication where supported
- Regular access reviews
Access is revoked immediately when employment or contracts terminate.
8. Authentication
Passwords must:
- Be unique
- Meet complexity requirements
- Never be shared
- Be stored only using approved hashing algorithms
Administrative accounts require MFA whenever available.
9. Technical Safeguards
Encryption
PHI is protected using encryption:
Data in Transit
- TLS 1.2 or higher
- HTTPS
- Secure APIs
Data at Rest
- Database encryption
- Disk encryption
- Encrypted backups where supported
Logging
Systems handling PHI maintain audit logs for:
- Authentication
- Authorization failures
- Administrative actions
- Data modifications
- Security events
Logs are protected from unauthorized modification.
Monitoring
Security monitoring includes:
- Failed login detection
- Suspicious access attempts
- Infrastructure monitoring
- Security alerts
- Availability monitoring
10. Physical Safeguards
SoftEd 21, S.L. (CTO Plus Team) uses cloud-first infrastructure and secure office practices.
Safeguards include:
- Controlled office access
- Screen locking
- Secure disposal of media
- Device encryption
- Locked workstations when unattended
11. Secure Software Development
Software handling PHI follows secure development practices including:
- Secure coding standards
- Code review
- Dependency management
- Vulnerability remediation
- Security testing
- Input validation
- Authentication and authorization controls
Production changes follow documented deployment procedures.
12. Data Retention
PHI is retained only as required by:
- Customer agreements
- Legal obligations
- Regulatory requirements
Data is securely deleted when retention periods expire.
13. Backup and Recovery
Systems containing PHI are protected through:
- Regular backups
- Disaster recovery procedures
- Recovery testing
- Business continuity planning
14. Incident Response
Security incidents involving PHI must be reported immediately.
Incident response includes:
- Identification
- Containment
- Investigation
- Remediation
- Documentation
- Customer notification where required
15. Breach Notification
If a breach involving unsecured PHI is confirmed, SoftEd 21, S.L. (CTO Plus Team) will:
- Investigate promptly
- Assess the scope
- Notify affected customers without unreasonable delay
- Cooperate with customer investigations
- Fulfill contractual BAA notification obligations
16. Vendor Management
Third-party vendors with potential access to PHI are evaluated for security controls before use.
Where appropriate:
- Business Associate Agreements are executed.
- Security reviews are performed.
- Access is limited to necessary functions.
17. Remote Work
Personnel working remotely must:
- Use company-approved devices when possible
- Encrypt laptops
- Use secure Wi-Fi
- Lock devices when unattended
- Avoid storing PHI locally unless required
- Report lost or stolen devices immediately
18. Mobile Devices
Devices accessing PHI should:
- Require authentication
- Support remote wipe where feasible
- Use encryption
- Be kept up to date
19. Customer Responsibilities
Customers remain responsible for:
- User authorization decisions
- Patient consent
- Regulatory compliance as Covered Entities
- Appropriate configuration of their environments
- Maintaining required HIPAA documentation
20. Workforce Responsibilities
All workforce members must:
- Protect PHI
- Follow security procedures
- Report suspected incidents immediately
- Complete required training
- Protect credentials
- Comply with this policy
21. Policy Review
This policy is reviewed:
- At least annually
- Following significant regulatory changes
- After major security incidents
- Following significant infrastructure changes
22. Contact
Questions regarding this policy may be directed to:
Privacy Officer
SoftEd 21, S.L. (CTO Plus Team)
Paseo Las Azucenas 18A, Marbella, 29602, Malaga, Spain
Email: privacy@ctoplusteam.com
Document Control
Document Title: HIPAA Privacy & Security Policy
Version: 1.0
Effective Date: July 25, 2026
Organization: SoftEd 21, S.L. (CTO Plus Team)
Classification: Internal / Customer Available