Research Data & Health Information
Our current posture, stated plainly
We Are Not Yet a Covered Entity
Computational Biomedical Systems does not currently operate as a covered entity or business associate under HIPAA. We do not hold a Business Associate Agreement with any organisation, and we do not receive, store, or process Protected Health Information.
This page describes how we handle research data today, and what we put in place before any project involving PHI could begin. We would rather over-state what we have not built than imply a compliance posture we have not earned.
Our closed-loop clinical engineering track is exploratory and pre-clinical. No work has been deployed in a care setting.
Five Questions We Have to Answer First
- 01Is a research question genuinely answerable without identifiable data?
- 02If not, what is the minimum identifiable dataset required?
- 03Which institution holds the data, and do they agree to the use?
- 04Is a data-use agreement executed, and does it cover our specific use?
- 05How will the data be deleted when the project ends?
Safeguards We Apply
Administrative
- Research involving PHI is scoped and documented before any data is requested
- A named data-protection contact is designated for each collaboration
- Data-access requests are approved per project, not granted by default
- Incident response procedures are agreed in writing with the partner institution
- Data-use agreements are executed before any transfer, not retroactively
Physical & Administrative Environment
- Access to any research dataset is limited to named personnel
- Devices used for PHI handling are encrypted and access-controlled
- Data is retained only for the period agreed in the data-use agreement
- Secure deletion is confirmed in writing at the end of a project
- Clinical site access follows the host institution's own policies
Technical
- TLS encryption for data in transit
- Encryption at rest for any stored research dataset
- Access logging on systems that hold identifiable data
- De-identification or pseudonymisation wherever the research question allows
- No PHI accepted through this website or by ordinary email
Planning Work Involving Health Data?
Contact us before any data moves. We would rather work through the governance questions up front than retrofit them afterwards.