Security & HIPAA

Counslr SOS handles emergency routing for telehealth sessions. This page defines the data classification, HIPAA compliance model, and security controls.

Data Classification

Location Data Handling

Patient location is the most sensitive data. The on-demand capture model ensures location is never at rest:

1. Patient grants geolocation permission at session start (SDK holds permission, does not transmit)
2. Counselor triggers SOS → server pushes location_request to patient via WebSocket
3. Patient SDK captures GPS coordinates → submits via POST /v1/platforms/{platformId}/sessions/{sessionId}/sos/location (TLS)
4. Lambda holds location in process memory only
5. Lambda queries PostGIS for nearest PSAPs using the coordinates
6. PSAP results returned to both SDKs
7. Location variable goes out of scope and is garbage collected
8. Crisis event logged to TrueVault records the event but not the coordinates

At no point is the patient’s latitude/longitude written to Aurora, DynamoDB, CloudWatch, or any persistent store.

Encryption

At Rest

In Transit

• TLS 1.2+ on all REST API endpoints
• WSS (WebSocket Secure) for real-time communication
• TLS for Aurora connections (sslmode=require)
• TLS for TrueVault API calls

Access Controls

• JWT tokens scoped per platform, per session, per role (patient/counselor)
• API keys follow Stripe model: publishable (client-safe) and secret (server-only)
• Role-based access: patient (location submission), counselor (SOS trigger), platform server (session management)
• Session expiry prevents stale location data

Audit Logging

• Crisis audit trail (Aurora): Tamper-evident HMAC-SHA256 hash chain for all crisis lifecycle events. Contains non-PHI metadata only
• Crisis event logs (TrueVault): PHI-adjacent crisis details stored under BAA. Never includes location coordinates
• Application logs (CloudWatch): Structured JSON via log/slog. No PHI in any log statement
• AWS CloudTrail: All API-level AWS access
• API Gateway access logs: All HTTP requests

Network Isolation

• Aurora deployed in private subnets (no public internet access)
• Lambda functions run inside VPC
• Security groups restrict traffic: Lambda → Aurora TCP 5432 only
• Lambda outbound: HTTPS to TrueVault and API Gateway management endpoints

Business Associate Agreements