HIPAA Compliance

Northgate Benefit Group, LLC has completed a HIPAA Security Risk Assessment of the Enrova.ai platform in accordance with 45 CFR §164.308(a)(1)(ii)(A), using the NIST SP 800-30 risk-assessment methodology, and maintains an active, documented risk-management program. On this basis we self-attest that Enrova.ai is operated in a HIPAA-compliant manner.

What this means — and what it does not. This is a self-attestation supported by a real risk assessment and the safeguards described below. It is not a certification, endorsement, or seal issued by the U.S. Department of Health and Human Services (HHS), the Office for Civil Rights (OCR), or any government body — no such official "HIPAA certification" exists. We do not claim government endorsement.

Technical

• Encryption of ePHI in transit (TLS) and at rest (AES-256).
• Role-based, least-privilege access control enforced on every protected request, with strict per-employer data isolation.
• Unique user accounts and multi-factor authentication (MFA) on all administrative accounts.
• Append-only audit logging of access to member data, retained for at least six years.

Administrative

• A designated Security Official and a completed, maintained risk assessment and risk-management plan.
• Written Sanction, Information Access Management, and Incident Response & Breach Notification policies.
• A written, restore-tested Contingency Plan (data backup, disaster recovery, emergency-mode operation).
• Workforce HIPAA training and annual policy review.
• Business Associate Agreements in place with every vendor that processes ePHI.

Ongoing Assurance

• Recurring independent penetration testing, maintained at a zero Critical / zero High-severity bar.
• Email anti-impersonation hardening (SPF, DKIM, and DMARC enforcement).
• Annual review of this program, and review after any material change or security incident.

If you believe your information may have been compromised, or you have a HIPAA-related question, contact us at privacy@northgatebenefitgroup.com. See also our Privacy Policy.