Security, privacy, and governance for regulated healthcare.
IXB applies identity, access control, encryption, auditability, data isolation, secure-development, and governance practices across approved deployments. Detailed evidence is available to qualified evaluators through a controlled process.
How regulated pharmacy data is protected.
Descriptions are deliberately high level. Control detail, tooling, and evidence are provided through the Trust Package rather than published.
Customer-data isolation
Customer data is isolated by customer, and access is governed within that boundary.
Identity and role-based access
IXB Identity provides the shared sign-in and authentication foundation for connected IXB applications. It supports enterprise identity connections, stronger authentication and governed access groups. Each application applies the permissions appropriate to its work, and customers control who can reach their data.
How IXB Identity supports access across the suite →Least privilege
Access is granted to the narrowest scope that lets someone do their job, and is reviewed rather than assumed to remain correct.
Encryption
Protected health information is encrypted at rest and in transit using industry-standard methods.
Audit logging
Activity involving protected health information and administrative actions is logged and reviewable according to applicable policy.
Secure development and vulnerability management
Security review is part of how changes are designed, built, reviewed, and released, and IXB maintains a vulnerability management process.
Backup and recovery
Backup and recovery processes exist for platform data. Recovery objectives are discussed against the specific deployment in scope.
Retention and deletion
Retention and deletion behavior is configurable to customer policy and applicable requirements.
Precise language, not badges.
IXB is designed to support HIPAA-regulated workflows, and Business Associate Agreements are available where required. Current certification and attestation status is available to evaluators, and customer-specific requirements and validation apply to each deployment.
IXB does not describe itself as certified by a regulator, and does not represent any compliance status that has not been verified for the specific offering and deployment being discussed.
Optional AI use and customer controls
AI assistance is optional in an IXB customer engagement. The agreed scope identifies the permitted tasks, data, provider arrangements and people responsible for reviewing the work. Any broader use requires separate assessment and authorization, subject to applicable requirements.
The initial Benefits Studio focus is draft benefit configuration and testing with synthetic member data. AI-authored designs remain subject to human review and controlled release. Embedded assistance and operational uses are evaluated separately; available capabilities and controls vary by deployment.
Ask IXB for the applicable data-flow description, access controls, review process and activation requirements as part of your evaluation. Permitted use depends on the customer’s program, applicable requirements and agreed deployment scope.
Detailed evidence through a controlled request.
Rather than publishing a long readiness matrix, IXB provides a controlled Trust Package to qualified evaluators, so materials stay current and we know who has what.
What the Trust Package can include
- Architecture overview
- Security-control descriptions
- Privacy and BAA posture
- Data flow and data-use statement
- Optional AI-use controls, when applicable
- Accessibility status
- Continuity overview
- Current certification and attestation status
- Customer questionnaire responses
Send us your security questionnaire.
The fastest way to evaluate IXB is against the questions your review already asks.