Request a pilot
Request a pilot

Healthcare & HIPAA

One governed workspace for ePHI work beyond the EHR.

IRONKEEP gives business associates and healthcare teams one place for mail, files, docs, chat, and meetings, with BAA-scoped onboarding where required.

Request a pilot

Workspace flow

How the suite supports ePHI work.

Each product covers one part of the workflow while identity, audit, retention, legal hold, and recovery stay shared.

01

MAIL

Keep ePHI in email, calendar, and contacts without moving between vendors.

  • Threat screening
  • Handling labels for ePHI
  • Team mailbox controls
02

DRIVE

Store and share healthcare files with scoped access and recoverable history.

  • Permissions
  • Version history
  • Upload scanning
03

DOCS

Co-edit policies, reports, spreadsheets, and presentations inside the workspace.

  • Comments
  • Suggestions
  • Version history
04

CHAT

Keep operational conversations and attachments inside the same governed scope.

  • Channels and DMs
  • Search
  • Retention
05

MEETINGS

Run invite-only calls and screen sharing without opening another collaboration boundary.

  • Guest controls
  • Encrypted recordings
  • Audited actions

Security for ePHI

Controls for a BAA-scoped workspace.

IRONKEEP keeps access, audit, retention, recovery, and organization separation consistent across the suite. Your organization still owns its HIPAA policies, risk analysis, training, and configuration.

01

Access and identity

Use IRONKEEP MFA or your identity provider through SAML or OIDC, with SCIM for user lifecycle control.

02

Audit and evidence

Sanitized events across mail, files, docs, chat, and meetings support review and scoped export.

03

Retention and recovery

Apply retention settings and legal holds, then recover earlier versions when records change.

04

Isolation and encryption

Organization data stays tenant-isolated with scoped keys, and IRONKEEP staff cannot read decrypted tenant content.

Implementation path

From HIPAA scope to a cleaner workflow.

  1. 01

    Scope ePHI workflows.

    Decide which teams, mailboxes, folders, docs, chat channels, and meetings may contain ePHI.

  2. 02

    Import email and files.

    Execute the BAA where required, then bring the agreed domain, users, mailboxes, files, and protected work into IRONKEEP.

  3. 03

    Set controls and evidence.

    Use identity, audit logs, retention settings, legal holds, and exports to support your compliance workflow.

Who it's for

Built for healthcare-adjacent teams handling sensitive work.

Business associates with shared evidence needs.

A billing, analytics, consulting, IT, or operations vendor needs BAA-scoped collaboration without scattering records across disconnected tools.

Covered entities coordinating outside the EHR.

A clinic, provider group, or health plan needs secure mail, files, docs, chat, and meetings for work that may contain ePHI.

Healthcare teams cleaning up tool sprawl.

Email in one place, files in another, chat somewhere else. IRONKEEP brings the workflow into one governed suite.

FAQ

Common HIPAA questions.

Will IRONKEEP sign a BAA?

Yes. If IRONKEEP creates, receives, maintains, or transmits ePHI for your organization, we sign a BAA during onboarding.

Is IRONKEEP a complete HIPAA compliance program?

No. Your organization owns HIPAA compliance, policies, training, risk analysis, record schedules, and legal review. IRONKEEP provides secure collaboration, access control, audit, retention, legal hold, and export tooling to support those workflows.

Where is customer data hosted?

Customer data is hosted in the United States. Tenant-scoped encryption keys and tenant isolation keep organizations separate and prevent routine operator access to tenant content.

Does HIPAA require every medical record to be kept for six years?

No. HHS says the HIPAA Privacy Rule does not set a medical-record retention period. State law and organization policy usually drive medical-record schedules, while HIPAA does require certain required documentation to be retained for six years.

What about retention, legal hold, and eDiscovery?

IRONKEEP supports configurable retention, matter-based legal holds, deletion blocks for held records, audit trails, and scoped exports for compliance or legal review.

Can IRONKEEP staff read my email?

No. Zero operator access to tenant content is enforced by explicit deny rules on decrypt operations. IRONKEEP staff cannot read decrypted tenant content, run tenant decrypt operations, create product users, or generate tenant search tokens.