HIPAA-Eligible CData Arc, Self-Hosted
Under a signed Business Associate Agreement, healthcare and life science organizations can run eligible EDI and MFT workflows involving ePHI on CData Arc deployed in their own environment.
Your Data Stays in Your Environment
Arc self-hosted runs on infrastructure you control and does not communicate with CData servers, so the PHI moving through your workflows is never seen by CData. CData signs the BAA for eligible use cases.
Encrypted Transfers
All transmissions use industry-standard encryption in transit (TLS 1.2+), with file-level encryption options such as Open PGP and AES for data at rest.
Access Controls
Authenticate users with LDAP, Active Directory, and more, and authorize services to specific users and groups.
Audit Logging
Audit-ready records of user events and file activity, searchable through a central admin API and exportable for compliance reviews.
What You Can Run Under a BAA
When a BAA is in place, eligible Arc self-hosted workflows may include:
- Exchanging HIPAA EDI transactions with payers, providers, and clearinghouses
- Secure file transfer of files containing ePHI between authorized parties
- Translating and validating healthcare data formats
- Automated, auditable workflows for authorized users
Self-hosted deployments only
HIPAA eligibility applies to CData Arc deployed in your own environment. It does not extend to other CData Arc offerings.
Know What’s Covered
Use cases outside the workflows above are not eligible for PHI, and CData does not support HIPAA compliance for them.
- A signed BAA with CData is required before ePHI is processed
- Eligibility is limited to self-hosted Arc running in your environment
- Do not send PHI to CData through support chat or email
Need a BAA for CData Arc?
Tell us about your organization and our legal team will follow up. You can also contact your CData sales representative.