Security & data integrity
Solia Direct separates consumer experiences from laboratory systems while applying access, encryption, provenance and environment-specific controls to patient data, orders and results.
Platform control model
How to read this page
Regulatory & compliance scope
Solia Direct is designed to support HIPAA-regulated laboratory workflows through deployment-specific safeguards and review. CLIA certification and CAP accreditation always remain with the laboratory — the distinctions below define what must be validated before Production and what stays with you.
Designed to support HIPAA-regulated workflows.
Production use of PHI requires deployment-specific safeguards, vendor and subprocessor review, data-flow review, and completion of applicable contractual requirements before activation. Solia Direct does not claim HIPAA certification or universal compliance independent of that deployment review.
Conditional prerequisite where required.
Where a Business Associate Agreement is required, an executed agreement and validated production configuration are prerequisites before PHI is used in Production. Applicability and contractual requirements are determined for each deployment.
Designed to support CLIA-certified laboratories.
CLIA certification is held by the laboratory, not by Solia Direct. The platform is designed to support CLIA-certified laboratory operations through validated interfaces, result integrity controls and auditable data handling, while the laboratory retains responsibility for its certification and clinical validation.
Designed to support CAP-accredited laboratories.
CAP accreditation likewise remains with the laboratory. Solia Direct supports accreditation workflows with traceable result provenance, version history for corrected or amended results, and controlled change management across integrations.
Not currently attested.
Solia Direct does not claim SOC 2, HITRUST or other independent attestations that have not been completed. Current control posture is described on this page and can be reviewed with your security team during diligence.
Reviewed during diligence.
Infrastructure providers and subprocessors relevant to a production deployment — including hosting, storage and communication services — are documented and can be reviewed during security and implementation diligence. Subprocessor scope is agreed per deployment.
Controls
Each control below states whether it is a platform control, configured for each Production environment, or dependent on the connected environment and Program.
Data is protected in transit using TLS and encrypted at rest within configured platform storage. Transport and storage protection apply to patient, order and result records handled by the platform.
Status: Platform control
Authentication, session handling and row-level authorization scope what laboratory, administrative and operational roles can read or change.
Status: Platform control
Records are scoped to a laboratory identifier throughout the data model. Production environments are configured with laboratory-scoped data boundaries and access rules for that laboratory's patients, orders and results.
Status: Production-configured
Security-relevant administrative, access and system events can be logged and retained according to the requirements agreed for each production deployment.
Status: Production-configured
The laboratory remains the authoritative source. Solia Direct receives, structures and presents results, preserves source metadata, maintains version history and distinguishes corrected or amended versions rather than redefining the underlying clinical result.
Status: Platform control
Laboratory APIs, LIS / LIMS interfaces, HL7 / FHIR feeds and third-party services are explicitly configured per environment and Program with credentials scoped to the narrowest required permissions.
Status: Environment / Program-specific
Production security review
Every Production environment is reviewed against the data flows, integrations and obligations that apply to that laboratory.
Identify patient data, PHI where applicable, order data, laboratory results, operational data and every external system connection in scope.
Configure laboratory boundaries, roles, permissions, authentication and environment access for the deployment.
Scope LIS / LIMS interfaces, laboratory APIs, HL7 / FHIR exchanges and third-party services, including credentials and required permissions.
Configure the applicable auditability, monitoring and retention requirements documented for the deployment.
Validate the production configuration against the agreed requirements before go-live.
Additional production controls
Principles
Solia Direct is a consumer layer on top of your systems. Reports, reference ranges and clinical interpretation stay with the laboratory.
Access for services, integrations and operational roles is scoped to the permissions required for their function.
We describe only controls that are implemented today or documented as production deployment requirements — never attestations that have not been independently completed.
Production environments undergo an environment- and Program-specific security and compliance review based on applicable data flows, integrations, hosting, access requirements and contractual obligations. Before PHI is used in Production, applicable HIPAA safeguards and Business Associate requirements must be validated and any required agreement executed.
Solia Direct does not claim SOC 2, HITRUST or other independent attestations that have not been completed. Infrastructure and subprocessors relevant to a production deployment can be reviewed during security and implementation diligence.
We can walk through the platform control architecture, integration model, data boundaries and production deployment requirements.
