HIPAA package

1. Where we are

Mycelium does not handle protected health information (PHI) by default. The package below documents the technical safeguards, the BAA terms, and the risk-assessment posture for healthcare customers who need PHI-aware memory. Full HIPAA certification will be added after the SOC 2 Type II foundation lands; the technical safeguards described here are already in production.

2. Technical safeguards

Each safeguard maps to the HIPAA Security Rule, 45 CFR §164.312:

• Access control: JWT-scoped per tenant, role-based access control (RBAC) on read, write, and synthesis paths, full audit log on every event.
• Audit controls: every read and every write carries timestamp, actor, tenant, and source. Audit exports are gzipped JSONL signed with a tenant key.
• Integrity: Git-versioned plain-text vault. Tamper-evident through the SHA-256 commit chain. Every memory entry is recoverable to any prior commit.
• Transmission security: TLS 1.3 in transit. HMAC validation on every inbound webhook receiver.
• Encryption at rest: AES-256 on the storage layer. Per-tenant encryption keys are on the roadmap and available today on the Mycelium Enterprise tier.
• Device and media controls: Vercel infrastructure carries SOC 2 and ISO 27001 attestations from the upstream provider. We rely on those controls for media and device handling and document them in our security review.

3. BAA template availability

A redlined Business Associate Agreement (BAA) template is available under NDA on request. Send to contact@myceliumai.co. Mycelium signs BAAs once the engagement letter is signed and the customer’s HIPAA-aware tenant configuration is provisioned.

4. Risk assessment posture

A HIPAA risk assessment matrix is maintained internally and shared under NDA. The matrix covers all 18 HIPAA identifiers, the technical safeguards above, and the five architectural pillars from the Reliability Manifesto: tenant isolation, audit completeness, transmission integrity, retry discipline, and reproducible recovery.

5. What's not yet certified

We name what is not done:

• SOC 2 Type II report (target Q4 2026)
• Independent HIPAA attestation
• FedRAMP authorization for HHS deployments

6. PHI-safe memory configuration

Customers who need PHI-aware memory get a tenant configured with PHI tagging on every typed memory entry, BAA-default audit-log retention (six years per HHS), and a separate vault root with no cross-tenant read paths. The configuration is shipped per customer; it is not a runtime flag, and it is not the default for the multi-tenant runtime.