Epic: HIPAA Technical Safeguards — Encryption, Access Control, Audit
SEC-001
End-to-end encryption for data at rest and in transit
Security5 SP
As a security engineer, I want all PHI encrypted with AES-256 at rest and TLS 1.3 in transit so that data is protected even if storage or network is compromised.
Acceptance Criteria
Given patient data is stored in Azure Health Data Services, When I inspect the storage configuration, Then Azure-managed keys (or customer-managed keys) are enforcing AES-256 encryption and no unencrypted blobs exist.
Given a buyer calls the data delivery API, When I inspect the connection, Then TLS 1.3 is enforced and TLS 1.0/1.1 connections are rejected.
SEC-002
Role-based access control via Azure Entra ID
Security5 SP
As a security engineer, I want all system access governed by Entra ID roles (patient, clinician, buyer, operator, admin) with least-privilege defaults so that each user can only access resources appropriate to their role.
Acceptance Criteria
Given a user authenticates as a "buyer" role, When they attempt to access patient-level records, Then access is denied with a 403 and the attempt is logged to the security audit trail.
Given a new role is created, When permissions are assigned, Then the role starts with zero permissions and each resource must be explicitly granted.
SEC-003
Comprehensive security audit logging
Security5 SP
As a compliance officer, I want every PHI access, authentication event, and system change logged immutably with timestamp, user, action, and resource so that we can respond to any HIPAA audit inquiry within 24 hours.
Acceptance Criteria
Given a clinician views a patient record, When the access occurs, Then an audit entry is written with: user ID, patient ID, resource type, action, timestamp, IP address, and consent status at time of access.
Given an auditor requests logs for the last 90 days, When the query runs, Then results are returned within 30 seconds and logs cannot be modified or deleted by any user including admins.
Epic: Zero Trust Architecture — Network Segmentation & Threat Detection
SEC-004
Network segmentation between portal tiers
Security5 SP
As a security engineer, I want each portal tier (patient, clinician, marketplace, admin) running in isolated network segments with no lateral movement so that a breach in one portal cannot reach another.
Acceptance Criteria
Given the marketplace portal (Door 3) is compromised, When the attacker attempts to reach the patient data store, Then all traffic is blocked by NSG rules and the intrusion attempt triggers an Azure Sentinel alert.
SEC-005
Automated vulnerability scanning
Security3 SP
As a security engineer, I want automated vulnerability scans running weekly against all deployed services so that known CVEs and misconfigurations are detected before they can be exploited.
Acceptance Criteria
Given a weekly scan runs, When a critical vulnerability is detected, Then a Sev-1 ticket is auto-created, the security team is paged, and a 48-hour SLA for remediation begins.
Given no new vulnerabilities are found, When the scan completes, Then a "Clean Scan" report is generated and archived for compliance records.
SEC-006
DDoS protection and rate limiting
Operator3 SP
As a platform operator, I want Azure DDoS Protection and API rate limiting on all public endpoints so that the platform remains available under attack and API abuse is throttled.
Acceptance Criteria
Given a buyer API key exceeds 100 requests/minute, When the rate limiter fires, Then subsequent requests receive 429 Too Many Requests and the event is logged.
Epic: HIPAA BAA Chain & Compliance Certification
SEC-007
Execute BAA with Microsoft Azure
Compliance3 SP
As a compliance officer, I want a signed Business Associate Agreement with Microsoft covering Azure Health Data Services so that our cloud infrastructure vendor is contractually bound to HIPAA requirements.
Acceptance Criteria
Given we provision an Azure tenant, When we accept the Microsoft Online Services BAA, Then the signed BAA is archived in our compliance vault and covers all HIPAA-eligible Azure services we use.
Given an auditor asks for our BAA chain, When we produce documentation, Then the chain shows: Moonlitic ↔ Microsoft Azure, Moonlitic ↔ Data Aggregator, Moonlitic ↔ Velo, Moonlitic ↔ Clear.
SEC-008
BAA with health data aggregator
Compliance2 SP
As a compliance officer, I want a signed BAA with our data aggregator (Data Aggregator / 1upHealth) so that PHI flowing through the aggregator is covered under HIPAA.
Acceptance Criteria
Given we select an aggregator vendor, When contract negotiation begins, Then BAA execution is a prerequisite before any patient data flows and the BAA specifies data categories, retention, and breach notification obligations.
SEC-009
SOC 2 Type II readiness assessment
Compliance8 SP
As a compliance officer, I want a SOC 2 Type II readiness assessment completed within 6 months so that enterprise buyers and health systems trust Moonlitic's security posture.
Acceptance Criteria
Given the readiness assessment begins, When gaps are identified, Then each gap has an owner, remediation plan, and target date, tracked in a compliance dashboard.
Given all gaps are remediated, When the external auditor begins the Type II observation period, Then all controls are operating effectively for a minimum 3-month observation window.
Epic: Incident Response & Breach Notification
SEC-010
Incident response playbook
Security5 SP
As a security engineer, I want a documented incident response playbook with roles, escalation paths, and runbooks for common scenarios (data breach, unauthorized access, ransomware) so that the team responds within HIPAA's required timelines.
Acceptance Criteria
Given a potential breach is detected, When the IR process begins, Then the playbook defines: who is notified within 1 hour, containment steps within 4 hours, and HHS notification within 60 days if 500+ records are affected.
Given a tabletop exercise is conducted quarterly, When the exercise completes, Then lessons learned are documented and the playbook is updated.
SEC-011
Breach notification to affected patients
Patient3 SP
As a patient, I want to be notified within 60 days if my data is involved in a breach, with clear information about what was exposed and what steps I should take so that I can protect myself.
Acceptance Criteria
Given a breach affecting my data is confirmed, When the notification period begins, Then I receive a letter (and email) describing: what data was exposed, when it happened, what Moonlitic is doing, and what I should do (credit monitoring, etc.).
SEC-012
Penetration testing program
Security5 SP
As a security engineer, I want annual third-party penetration testing against all portals and APIs so that vulnerabilities are identified by external experts before malicious actors find them.
Acceptance Criteria
Given the annual pen test is scheduled, When the test completes, Then all critical and high findings have remediation plans within 7 days and are resolved within 30 days.
Given the pen test report is finalized, When an enterprise buyer requests security documentation, Then a redacted executive summary is available showing test scope, methodology, and finding counts by severity.