Data Encryption & Storage
Medecision’s platform is hosted entirely on Google Cloud Platform (GCP) and leverages industry-standard encryption, access controls, and key management to protect sensitive healthcare data. This document outlines how data is encrypted in transit and at rest, how keys are managed, and how storage is secured across the Medecision ecosystem.
Data Encryption Overview
Medecision enforces encryption at all stages of data handling:
Stage | Encryption Method | Protocol |
In Transit | TLS (Transport Layer Security) | TLS 1.2+ |
At Rest | AES-256 (Advanced Encryption Standard) | GCP-managed storage encryption |
Backups | AES-256 with versioning | Replicated and encrypted snapshots |
Internal APIs | Encrypted over HTTPS | With mutual TLS (mTLS) where applicable |
All encrypted data complies with HIPAA, HITRUST, and NIST SP 800-53 guidelines.
Key Management (KMS)
Medecision utilizes Google Cloud’s Key Management Service (KMS) for managing and rotating encryption keys.
Key Handling Practices:
All data encryption keys (DEKs) are automatically rotated by GCP.
Key Encryption Keys (KEKs) are used to protect DEKs.
GCP KMS logs key access and rotation events.
Customer-Managed Keys (CMKs)
Supported for clients requiring control over their encryption keys.
Keys can be hosted in the client’s own GCP project and linked via IAM.
Client keys are never exported from their GCP tenancy.
Storage Architecture
Medecision uses multiple GCP storage services to meet platform requirements:
Component | Storage Type | Use Case |
BigQuery | Columnar data warehouse | Reporting, analytics, rules processing |
Cloud Storage (GCS) | Object storage | Raw file ingestion, fax, PDF exports, backups |
Firestore | NoSQL document DB | Timeline metadata, user sessions, audit trails |
Cloud SQL / Postgres | Relational database | Real-time transactions, workflow tables |
All services support encryption by default and are managed within encrypted GCP VPC networks.
Access Control for Storage
IAM policies restrict access to data storage based on principle of least privilege.
Service accounts scoped to individual workflows and ingestion pipelines.
Data access by Medecision personnel is logged, monitored, and governed by need-to-know.
Customer teams only access data for their tenancy; enforced by project-level isolation.
Backup & Retention
Daily encrypted backups of critical systems.
Retention periods aligned with CMS and client BAA requirements (typically 6–10 years).
Regional replication for disaster recovery (RPO < 4 hrs, RTO < 12 hrs).
Test restores performed semi-annually.
Monitoring & Alerting
Encryption compliance metrics monitored through GCP Security Command Center.
Storage access logs audited daily.
Alerts generated for unusual access patterns or failed encryption policies.
Client-Specific Enhancements
Clients may request:
Dedicated GCP projects
Customer-supplied encryption keys
Separate storage buckets for inbound faxes, claims, and PHI exports
Custom audit reporting available for encryption verification
Medecision’s approach to encryption and storage ensures that all protected health data remains secure, compliant, and readily available across all workflows, modules, and APIs.