Compliance Posture
Compliance built in, not bolted on.
Most EHRs treat 42 CFR Part 2 as a checkbox. Auxo enforces it at the middleware layer — the only place it can’t be forgotten. Sleep better. Survey easier. Defend cleaner.
The 42 CFR Part 2 problem
Most EHRs treat SUD records like any other PHI. That’s a federal violation.
42 CFR Part 2 isn't HIPAA — it's stricter. Substance use records require explicit consent for disclosure, separate audit trails, and re-disclosure warnings on every export. Auxo enforces all three automatically.
Treatment-staff exemption
Clinicians, therapists, and nurses bypass consent checks for the patients they're treating — exactly as Part 2 allows.
Consent enforcement
Non-clinical roles must have an active ConsentForDisclosure with includesSudRecords:true to see SUD data. No consent = no record.
Parallel audit trail
Every SUD-record read writes to SudAuditLog — separate from AuditLog so federal surveyors get a clean export.
Mandatory re-disclosure notice
Every API response carrying SUD data appends the federally-required re-disclosure language. Your integrations are warned.
The compliance stack
Eight layers between your data and a breach.
Every read, every write, every download passes through this stack. There’s no admin shortcut, no ‘quick fix’ that bypasses it. By design.
Authentication & RBAC
JWT + role-scoped permissions. Clinical roles get treatment-staff exemption for SUD records. Non-clinical roles require explicit ConsentForDisclosure.
PHI Encryption (at rest)
Field-level AES-256 encryption on every PHI column. Encryption key rotated via PHI_ENCRYPTION_KEY rotation playbook. Never logged, never echoed.
Prisma Middleware Stack
Encrypt → Decrypt → Soft-delete filter → Audit. Four ordered layers run on every read and write. You can’t bypass them by accident.
Dual Audit Logs
AuditLog tracks all PHI access. SudAuditLog runs separately for 42 CFR Part 2 records — a parallel trail your DEA & federal surveys will ask for.
Re-Disclosure Notices
Every API response containing SUD data carries the federally-mandated re-disclosure notice. Your downstream integrations get the warning automatically.
Row-Level Security (multi-tenant)
Postgres RLS enforces facility and org isolation at the database itself. One tenant can never read another’s rows — even if application code has a bug.
Break-glass & session control
Mandatory MFA with WebAuthn passkeys (Face ID / Touch ID). Emergency break-glass access is fully audited, and admins can review and revoke active sessions in real time.
Network & Storage
Encrypted enterprise object storage with server-side encryption. Signed URLs only. Rate limiting on public endpoints. Circuit breakers on every third-party call.
Survey-ready, year-round
Accreditation isn’t a fire drill. It’s a dashboard.
Auxo tracks Joint Commission and CARF readiness continuously, keeps provider credentials current, and drives follow-through with configurable workflows — so the next survey is a report, not a scramble.
Accreditation dashboard
Live readiness for Joint Commission and CARF standards, with the evidence trail attached to each requirement.
Provider credentialing
Track licenses, DEA, NPI, and expirations. Get warned before a credential lapses — not after a claim denies.
Workflow automation
Rule-based workflows chase overdue compliance tasks and escalate, so nothing falls through the cracks between surveys.
One audit trail
Accreditation, credentialing, and clinical activity all write to the same tamper-evident audit trail surveyors can export.
Standards we respect
The acronyms your survey will ask about.
HIPAA
Privacy + Security Rules
42 CFR Part 2
SUD confidentiality
HITECH
Breach notification
TX HSC §181
Texas Med Privacy Act
21 CFR Part 11
E-signature integrity
NIST 800-66
HIPAA Security mapping
HL7 / FHIR R4
Interoperability
SOC 2
In progress 2026