HIPAA file integrity monitoring
Know when ePHI files change, go missing or never arrive.
The Security Rule asks you to protect ePHI from improper alteration or destruction, and to review system activity regularly. Alertica checks the folders where your claim files, lab results and backups live from outside your servers, alerts the people you choose, and records who reviewed each alert and why. We sign a BAA with every customer who needs one.
- Agentless, nothing to install
- BAA on request
Who it's for
Covered entities and business associates that keep ePHI in files on servers they run.
Built for
- Health-tech companies, medical billing firms, labs and clearinghouses
- Claim, eligibility and lab result files exchanged with partners over SFTP
- Backups of your own servers, checked every night
What Alertica covers in the Security Rule
Six safeguards Alertica supports for ePHI in files, with what stays with you in the last column.
| Section | What it asks | What Alertica does | What you still do |
|---|---|---|---|
| 164.312(c)(1) Integrity | Protect ePHI from improper alteration or destruction. | Alerts when files in the folders you watch are changed, deleted or never arrive. | Control access to the files, and back them up. |
| 164.312(c)(2) Mechanism to authenticate ePHI (A) | Use electronic mechanisms to confirm ePHI hasn't been altered or destroyed without authorization. | Fingerprints each watched file with SHA-256 on your server, and alerts when the contents change even if the date doesn't. | Record the choice in your risk analysis, as for any addressable specification. |
| 164.308(a)(1)(ii)(D) Information system activity review (R) | Regularly review records of system activity. | The weekly health email and the acknowledgement notes are a regular review, on record. | Review access reports and audit logs from your systems. |
| 164.308(a)(6)(ii) Response and reporting (R) | Identify and respond to suspected incidents, and document them and their outcomes. | Each alert is acknowledged with who, when and a required note saying what they found and did. | Decide what counts as an incident, and report breaches. |
| 164.308(a)(7)(ii)(A) Data backup plan (R) | Create and maintain retrievable exact copies of ePHI. | Alerts when a backup file doesn't arrive, shrinks sharply, or changes once stored. | Make the backups, and prove they restore. |
| 164.312(b) Audit controls | Record and examine activity in systems that hold ePHI. | Scan history records every change to the files you watch. | Record who accessed and changed ePHI, in your systems' audit logs. |
What your reviewer sees
Whoever reviews your HIPAA program, an outside assessor, a customer's security team or OCR in an investigation, asks what happened on given dates. Alertica keeps the answer for every date.
-
Every alert, with who reviewed it
Each alert is acknowledged with a name, a time and a required note. That note documents the incident and its outcome, as 164.308(a)(6) asks.
-
Twelve months of history
Pro keeps a year of alerts and scans, so any date a reviewer asks about has its record.
-
Proof of regular review
Every Monday, a health email per rule: scans that ran, scans that failed, alerts, and what is still open. Week by week, it shows the regular review 164.308(a)(1) asks for.
-
The record in one download
Pick the period and download every alert with who reviewed it, when and the note. A PDF to hand over, or a spreadsheet to filter.
Why from outside the server
-
Nothing to install
No agent to roll out or patch, and no change request on the server. Alertica logs in over SFTP with a read-only login.
-
Nothing to switch off
An attacker on the server can stop an agent. Alertica runs on our servers, out of their reach.
-
File contents stay put
Alertica works out a fingerprint of each file on your server. The contents never leave it. It keeps names, sizes and dates, so keep patient details out of file names where you can.
-
Set up with you
On Pro and Enterprise our team sets the rules for your SFTP exchange and backups with you, folder by folder.
Live in three steps
-
Connect a server
Add a server with an SFTP, FTPS or FTP login. A read-only login is enough.
-
Set your rules
Pick a folder and say what matters. We set up the rules for your exchange with you on Pro.
-
Choose who hears about it
Add the people who should get alerts, by email, SMS or Slack. Each one is kept on record.
Questions about HIPAA
What Alertica covers in the Security Rule.
-
Is Alertica HIPAA compliant?
HIPAA applies to how your organization protects ePHI, not to a product on its own. Alertica supports the safeguards in the table above, and we sign a BAA.
-
Will you sign a business associate agreement?
Yes. File names can contain ePHI, so we sign a BAA with every customer who needs one. Ask us and we'll send it.
-
Do you see patient data?
Alertica never reads file contents; only a fingerprint of each file leaves your server. It does keep file names, so keep names in watched folders free of patient details where you can.
-
What does Alertica record for each change?
What changed and when it was found, who was told, and who reviewed it, with their note. Who made the change is in your server's own logs, and the note is the place to record it.
-
Is the Security Rule changing?
HHS proposed changes in January 2025. They are still a proposal, and HHS lists final action for July 2027. This page describes the rule in force today.
Set up your file monitoring with our team
Tell us where your ePHI files move and where your backups land. We'll set up the rules with you and go through the first scan together.