Anonymous denial uploads and derived prefill cache
Owner: Privacy Officer
24 hours active, then encrypted archive pending case linkage or deletion review
Legal reviewSecurity and privacy
Clear boundaries for sensitive appeal information.
DenialHelp publishes the controls that are operating now and distinguishes them from planned work. Contract coverage, service eligibility, data class, and runtime checks all have to agree before protected health information may leave the application.
Encryption and isolation
Sensitive application data stays on the encrypted data volume and travels over TLS. Backups and recovery evidence are checked operationally; a hosting-company name alone is not treated as proof.
Access and audit
Appeal access is scoped to the case credential or an explicitly consented professional grant. General security records are PHI-minimized and append-only at the database boundary; canonical case events and AI-handling receipts add hash-chain tamper evidence.
AI routing
Every AI path declares its provider, model allowlist, permitted data class, retention/training posture, and failure mode. Raw PHI is refused if the approved de-identification path is unavailable.
Uploads and temporary files
Anonymous uploads and derived files remain on the encrypted PHI volume. Archive operations refuse symbolic links and cross-filesystem moves; destructive clinical retention is paused pending policy approval.
Legal holds
A legal hold overrides destructive retention. Case, document, communications, billing, and audit records use separate record-class decisions instead of a blanket one-size-fits-all period.
Monitoring and response
Security alerts and operating logs must remain PHI-free. Access anomalies, incidents, backups, and privileged jobs have named owners and runbooks.
Vendor and data-class register
This public view intentionally excludes contract documents and internal evidence locations. Each entry was reviewed on the date shown; enabling another service requires a new eligibility and privacy review.
| Service | Purpose | Permitted data | Boundary | Reviewed |
|---|---|---|---|---|
| Amazon Web Services | Textract OCR, encrypted S3 backups, Lightsail TLS gateway | public, internal, pii, phi, deidentified | Executed BAA; approved services only | 2026-08-28 |
| Paubox Email API | transactional email | public, internal, pii, phi, deidentified | Executed BAA; approved services only | 2026-08-28 |
| Google Workspace | operator mailbox, administrative notifications | public, internal, pii, phi, deidentified | Executed BAA; approved services only | 2026-08-28 |
| Claude subscription CLI | AI inference after formal de-identification | public, internal, deidentified | No BAA asserted; de-identified data only | 2026-08-28 |
| Anthropic API | non-PHI development and explicitly classified public/internal workloads | public, internal, deidentified | Not used for PHI | 2026-08-28 |
| Stripe | payment and subscription billing using PHI-free metadata | public, internal, financial_non_phi | Not used for PHI | 2026-08-28 |
| Cloudflare DNS | authoritative DNS only | public | Not used for PHI | 2026-08-28 |
| Sentry | PHI-scrubbed error and performance telemetry | public, internal | Not used for PHI | 2026-08-28 |
| Telegram Bot API | aggregate PHI-free operational alerts | public, internal | Not used for PHI | 2026-08-28 |
| Stedi Healthcare Eligibility | X12 270/271 eligibility checks | public, internal | Review pending | 2026-08-28 |
| Google Analytics / PostHog | aggregate public-site analytics only | public | Not used for PHI | 2026-08-28 |
Retention by record class
Schedule 2026-08-28.1
Hardship applications, denial evidence, and financial-need narrative
Owner: Privacy Officer
Current 30-day deadline is an interim minimization control; destructive disposition requires privacy and legal approval
Legal reviewCase, clinical evidence, documents, communications, and filed artifacts
Owner: Privacy Officer
Jurisdiction-, role-, contract-, and legal-hold-specific; existing seven-year deadlines are interim and require review
Legal reviewHIPAA-required policies, procedures, assessments, and approvals
Owner: Privacy Officer
6 years
ReviewedAccess, security, and AI-handling audit evidence
Owner: Security Officer
6 years unless a longer legal hold applies
ReviewedPHI-free billing events and reconciliation evidence
Owner: Finance
Finance/tax policy; jurisdictional review required
Legal reviewReport a security or privacy concern
Do not include patient information in the first message. Ask the support team to escalate the report to the Security or Privacy Officer.
hello@denialhelp.com