Home › Histopathology LIS › Security
Security & data protectionHow we protect laboratory & patient data
The Unimeditrek Histopathology LIS is built with security controls aligned to the HIPAA Security Rule safeguards and ISO/IEC 27001 control areas. This page describes the technical controls in the product — honestly, and without overclaiming.
Encryption in transit
All traffic is served over HTTPS/TLS 1.2+. HL7 v2 (MLLP) and FHIR R4 interfaces run over authenticated, encrypted channels.
Encryption at rest
Optional AES-256-GCM field-level encryption for sensitive patient contact data, plus disk/volume encryption and encrypted backups at the infrastructure layer.
Strict tenant isolation
Every lab is a separate tenant; one laboratory can never see another laboratory’s patients, cases or reports.
Zero-knowledge support access
Our staff cannot read a laboratory’s patient data without a lab-approved, time-limited, fully-audited support grant — access is off by default.
Complete audit trail
Every clinical action — accessioning, staining, reporting, sign-out — is recorded with user, time and change, for accountability and inspection.
Role-based access control
Per-lab roles (pathologist, technician, admin) scope what each user can see and do; report authorization is restricted to signing pathologists.
Interoperability
HL7 v2 and FHIR R4 endpoints for HIS/EMR integration and standardized data exchange.
Data residency
Hosted in India; your laboratory’s data stays within your tenant boundary.
Controls in the software vs. certification
We build the technical safeguards above. “HIPAA-compliant” and “ISO 27001-certified” are organizational programs — they require policies, staff training, risk assessments, Business Associate Agreements, breach procedures and independent third-party audits that apply to your organization as well as ours. We will not claim a certification we do not hold.
- The product provides the technical controls described here.
- Your laboratory remains the data controller and is responsible for its own compliance program, staff and processes.
- We can provide documentation of our controls and a Business Associate / data-processing agreement on request to support your compliance efforts.