Security at VitalWay
Your health data deserves the same security infrastructure that protects financial institutions. Here's exactly how we protect it.
Health Data Stays With Your Care Platform
Your intake, medical history, prescriptions, orders, and payments are handled on our telehealth partner's HIPAA-covered platform. The VitalWay website does not collect or store your health information.
Encryption in Transit
Every page and form is served over HTTPS with HSTS, and strict security headers (CSP, X-Frame-Options) are enforced on all routes.
Multi-Factor Authentication
MFA is required for every VitalWay staff account, and staff sessions expire automatically.
Audit Logging
Staff activity in our admin tools is recorded in an append-only audit log that application users cannot modify or delete.
Least-Privilege Access
Staff can only reach the tools their role requires, and no VitalWay staff role has access to clinical records.
No Health Data in Analytics
Analytics run only on public marketing pages and never receive health information, and we do not use health information for advertising.
Compliance standards
HIPAA
HIPAA-ready technical safeguards implemented across all PHI systems.
SOC 2 Type II
Audit preparation underway with target completion in Q4 2025.
OWASP Top 10
Security controls address all OWASP Top 10 categories.
NIST CSF
Security program aligned to NIST Cybersecurity Framework.
Responsible Disclosure
If you discover a security vulnerability in our systems, we ask that you report it to us privately before public disclosure. We are committed to investigating and resolving reported vulnerabilities promptly.
Report vulnerabilities to: security@vitalwayhealth.com
We will acknowledge receipt within 48 hours and provide a resolution timeline. We do not take legal action against researchers who responsibly report vulnerabilities.