medTRANS does not host PHI on general-purpose commercial web hosting, in a marketing platform, or in a form-builder SaaS. This portal and its underlying case-file storage run on Atlantic.Net HIPAA-Compliant Hosting (HIPAA Business tier) — a dedicated, managed, audited environment purpose-built for ePHI.

What that provider brings to the arrangement:

• A signed Business Associate Agreement. Atlantic.Net executes a BAA for every HIPAA customer, contractually binding them to safeguard PHI. Infrastructure without a BAA is not HIPAA-usable at any price; ours has one.
• Independent HIPAA / HITECH audit. The environment is audited by a third-party CPA firm under the HIPAA attestation standards (AT-C 105/205) covering physical, environmental, technical, and administrative controls.
• SOC 2 Type II and SOC 3 Type II — audited annually. SOC 3 is publicly shareable; SOC 2 Type II is available to you or your auditor under NDA.
• HITRUST-audited data centers, with ISO 27001 certification and PCI DSS alignment on the same infrastructure.
• Managed security services included: managed firewall, intrusion detection and prevention, encrypted VPN administrative access, encrypted storage, log inspection, and file-integrity monitoring.
• Encrypted onsite and offsite backups as standard, supporting the contingency-plan requirement at §164.308(a)(7).
• U.S.-based private data centers owned and operated by the provider, with 24/7/365 staffed support and a redundant network SLA. No offshore processing of your client's PHI.

Atlantic.Net has operated since 1994, is recognized by Gartner in its market guide for cloud service providers to healthcare delivery organizations, and serves Fortune 500 healthcare customers. We chose infrastructure that was already carrying regulated healthcare workloads before we arrived.

The most useful security question a broker can ask is not "is it encrypted" — it is "who reads it." Here is the whole path your client's census takes:

• 1. Receipt. Your upload is received by our automated intake process, which validates the submission, confirms the attachments against the requested tier, and issues your acknowledgement. It does not email your files anywhere.
• 2. Deposit. The intake process deposits the files into a newly created, permissioned SharePoint case-file folder for that employer group. This is the only copy of record.
• 3. Access. That folder is restricted to the Underwriting team and the Executive team. Nobody else in the organization — not sales, not marketing, not administrative staff, not the captive manager's general personnel — is granted access to it.
• 4. Excluded by design. Our developers, infrastructure engineers, and technology vendors build and maintain the platform without PHI access. They do not hold credentials to the case-file folders, and production PHI is never copied into development or test environments. Access exclusion is enforced by permission, not by policy alone.
• 5. AI and automation. Where automation assists intake and normalization, it runs under an enterprise agreement with an executed Business Associate Agreement. Submitted data is not used to train third-party models and is not retained by the AI provider for its own purposes.
• 6. Output. Only the finished Illustration, Indication, or Proposal leaves the case file, and only to the recipient you designate on page 1 under the Outbound Communication and Recipient Protocol.

Net effect: the number of human beings who see your client's PHI is small, named, trained, individually authenticated, and logged. We will tell you the count for your case if you ask.

Any vendor who tells you their hosting provider makes them HIPAA compliant does not understand the rule. Compliant infrastructure is the floor, not the building. HIPAA compliance is determined by the covered entity's and business associate's total adherence to the Privacy and Security Rules — the application, the workforce, and the operating practices, not just the server. Here is the honest division of labor, so you can audit us on the right things:

Atlantic.Net's side of the line: data-center physical security, environmental controls, host-level hardening and patching, managed firewall and IDS/IPS, disk encryption, encrypted backups, network availability, and the audit attestations listed above.

medTRANS's side of the line — and the part you should actually be asking us about:

• Application-layer security of this form: TLS enforcement, upload validation, file-type and size restrictions, malware scanning on upload, protection against injection and traversal attacks.
• Identity and access management: unique named accounts, enforced MFA, role-based authorization, quarterly access reviews, and same-day deprovisioning on termination.
• Application audit logging — who opened which case file and when. The host logs the server; only we can log the underwriter.
• Workforce controls: annual HIPAA training with documented completion, signed confidentiality agreements, background checks, and a sanctions policy for violations (§164.308(a)(1)(ii)(C) and (a)(5)).
• Written policies and a current risk analysis under §164.308(a)(1)(ii)(A), reviewed annually and after material system change.
• Named Privacy Officer and Security Officer (§164.308(a)(2), §164.530(a)).
• Incident response and breach notification procedures, tested, with defined timelines.
• Downstream BAAs with every subcontractor that touches PHI — the hosting provider, the SharePoint case-file platform, TPAs, PBM data feeds, actuarial reviewers, and the AI/automation layer used in intake. All are executed and registered; see the access model below.
• Retention and secure destruction of submissions that never bind.
• Third-party penetration testing and vulnerability scanning of this application, not merely of the host.

We publish this list deliberately. It is the list your client's compliance counsel will ask for, and we would rather hand it to you before you have to ask.

Brokers frequently assume email is acceptable because it is customary. Customary is not the standard; §164.312(e) is. Compare:

If your own compliance policy requires secure transmission of ePHI to business associates, this portal is how you satisfy it with us. The submission record we generate also gives you documentary proof of what you sent and when — useful the day someone asks.

The safest PHI is the PHI you never transmit. Underwriting rates on demographics and claims magnitude, not identity. Before uploading:

• Remove Social Security numbers entirely. We never need them. Use the TPA's member or subscriber ID.
• Names are optional. A unique subscriber ID plus a dependent sequence is sufficient for every tier, including Proposal. If your census carries names, you may replace them with IDs — just keep the family key intact so dependents map to subscribers.
• ZIP code only — five digits. Street addresses are not used in rating.
• Keep the family key. This is the one thing we cannot reconstruct. Removing it blocks the case, so de-identify the name column rather than the linkage column.
• Large-claim reports: diagnosis and claimant ID are needed for clinical review; claimant names are not.
• Do not password-protect the files. The channel is already encrypted, and passwords sent separately by email defeat the purpose while creating a second breach vector.

If you are unsure whether a field is needed, upload without it. Underwriting will request it specifically if the tier requires it.

Submissions are retained inside the case file for as long as the underwriting record must be kept, and no longer:

• Bound cases: retained for the policy term plus the applicable statutory and reinsurance retention period, as the underwriting file of record.
• Declined, withdrawn, or non-bound submissions: retained 24 months to support re-quote and audit, then securely destroyed.
• Secure destruction follows NIST SP 800-88 media sanitization guidance; encrypted backups age out on the same schedule rather than persisting indefinitely.
• Early deletion on request. The covered entity — the employer's plan — may request earlier destruction in writing at any time, subject only to legal-hold obligations. We will confirm completion in writing.
• No secondary use. Your client's PHI is used to underwrite your client's case. It is not sold, not licensed, not used to train third-party models, and not repurposed for marketing to the employer or to you.

Aggregate, de-identified experience data may inform medTRANS's manual rating basis. De-identification follows the §164.514(b) Safe Harbor method — all eighteen identifiers removed — so the result is no longer PHI.

Two things worth being clear about, because they protect you:

1. Confirm your authority to disclose. If you are the broker or consultant of record, you are ordinarily a business associate of the employer's group health plan and your disclosure to medTRANS for underwriting is a permitted health-care-operations use — but that rests on your BAA with the plan, not on ours. If you do not hold one, or if you are submitting for a prospect you do not yet represent, get written authorization from the plan sponsor first. We will not ask you to prove it, and we cannot cure its absence.

2. Secure your own end. The encrypted channel starts at your browser. It does not protect a census sitting unencrypted on a laptop desktop, a file shared through a consumer file-sync link, or a spreadsheet forwarded to a colleague after you upload it here. Submit from a managed device, and delete your working copy when the case closes.

If your client's plan requires a direct BAA with medTRANS before any PHI moves, tell us before you upload. We will execute one — typically same business day — and it does not delay your quote.

How to read this. Policies marked In force are adopted and available on request. Policies marked In development are drafted and pending executive adoption — we list them rather than hide them, so you can see the full program and its completion state. Nothing below is represented as adopted until it is.

The Register PDF lists every policy, its status, its owner, and its HIPAA citation. Individual policy documents and the evidence pack are released by the Privacy Officer on request, subject to NDA where noted.