BioinvestGPT ApS · Research use only
Security and HIPAA-compliant architecture
BVCT runs on a HIPAA-compliant architecture: personal data is encrypted with AES-256-GCM, passwords are hashed with Argon2id, access tokens are short-lived, and data operations are written to a tamper-evident audit log. BVCT is patient-data-free by design, so running a virtual trial does not require patient records.
Last updated · Maintained by BioinvestGPT ApS
What does "HIPAA-compliant architecture" mean here?
It means BVCT's technical safeguards are designed around the technical safeguard standards of the HIPAA Security Rule (45 CFR §164.312): access control, audit controls, integrity, person or entity authentication, and transmission security. It is not a certification. HIPAA has no official certification, and whether a particular organization's use of BVCT meets HIPAA also depends on that organization's own policies and agreements.
Which safeguards does BVCT implement?
| Standard | How BVCT implements it |
|---|---|
| Access control, §164.312(a) | Individual accounts with unique user IDs; role- and permission-scope checks on data routes; re-authentication with the password after a page reload. |
| Encryption at rest, §164.312(a)(2)(iv) | Personal fields in the database are encrypted with AES-256-GCM. Account data kept in the browser is encrypted with AES-256-GCM through the Web Crypto API. |
| Audit controls, §164.312(b) | Sign-in events and data operations are written to an append-only audit log. Each entry is hash-chained to the previous one, so alteration or deletion is detectable. |
| Integrity, §164.312(c) | AES-256-GCM is authenticated encryption: modified ciphertext fails to decrypt. The hash-chained audit log protects the record of operations. |
| Person or entity authentication, §164.312(d) | Passwords are hashed with Argon2id. Access tokens are signed and expire after 15 minutes, with separate refresh tokens. Sign-in endpoints are rate-limited. |
| Transmission security, §164.312(e) | All traffic uses HTTPS (TLS 1.2 or later), with HTTP Strict Transport Security. |
Does BVCT need patient data?
No. BVCT is patient-data-free: a virtual trial is specified at population and trial level (drug, disease, comparator, endpoint and eligibility criteria), so running one does not require patient records. In the research workflow for off-label hypotheses, questions that contain individual-patient detail are rejected in the browser and again by the server (HTTP 422).
Some optional design workflows can call third-party computation services. Submissions to a public service that is not covered by a Business Associate Agreement (BAA) are blocked unless the user confirms, for that run, that the input contains no protected health information; the confirmation is recorded in the audit log.
What does this page not claim?
This page describes technical safeguards in the platform's code and hosting. It is not a legal opinion, an audit report or a certification, and it does not describe the contractual terms, such as a Business Associate Agreement, that apply to any customer. For security documentation, contact BioinvestGPT ApS.