Where our clinical platform runs, and how health information is protected

Mind Rehab's platform runs in its own AWS account in US East (N. Virginia), covered by a signed AWS Business Associate Addendum. Production runs in its own network (VPC), separate from development.

HomeWAV tablet or browserHTTPS only. Plain HTTP is redirected to HTTPS.

AWS WAFWeb firewall with AWS managed rule sets

Load balancerApplication Load Balancer across two Availability Zones

App server (Moodle 4.5)Private subnet, no public IP address, no SSH key pair

DatabaseRDS MySQL, Multi-AZ, encrypted

File storageAmazon EFS, encrypted

Production VPC: load balancer, app server and data, separate from development

Agreement & account

AWS Business Associate Addendum active since May 21, 2026
Root account protected with multi-factor sign-in (MFA), with no root access keys
Dedicated AWS account for Mind Rehab, production and development in separate networks (VPCs)

Edge & network

AWS WAF on the production load balancer, using AWS core and known-bad-inputs rule sets, with request logging
HTTPS listener; port 80 permanently redirects to HTTPS
The app server accepts traffic only from the load balancer. Outbound internet goes through NAT gateways only

Database

Amazon RDS for MySQL 8.0, Multi-AZ with a standby in a second Availability Zone
Encrypted at rest with a dedicated AWS KMS key; deletion protection on
Automated backups with 7-day point-in-time recovery; automatic minor version upgrades
Accepts connections only from the application tier

Servers & files

Moodle 4.5 on Amazon EC2 in a private subnet: no public IP address, no SSH key pair
Server disks encrypted with AWS KMS, separate keys for production and development
Course files on Amazon EFS: encrypted at rest, stored across Availability Zones, reachable only from the app tier

Monitoring & audit

AWS CloudTrail multi-region trails for production and development (account activity log)
Amazon GuardDuty threat detection turned on
Detailed EC2 monitoring, plus web firewall metrics and logs in CloudWatch

Inside the platform

Learner messaging and blogs turned off; no outside links in course content
Learners can't self-register; accounts come from the tablet sign-in or staff
Platform details are on the Moodle setup one-pager

Course laneCourses launch from HomeWAV tablets. Only course activity travels back to your reporting, with a coded learner ID if you prefer.

Clinical laneForms, screeners and care-team notes stay in this environment. HomeWAV never has to hold health information; identified data goes only to facility care teams under a BAA.

HIPAA is a shared responsibility, not a certificate. Before any health information moves, we map the data flow with your team and sign a BAA with HomeWAV or the facility. We'll answer your vendor security questionnaire in writing.Ashley Miller, PMHNP-BC
Ashley@mind-rehab.com