Is Oyma suitable for healthcare practices requiring HIPAA compliance?

Healthcare Compliance in a Local-First Context

The Health Insurance Portability and Accountability Act (HIPAA) Security Rule establishes strict national standards to protect individuals’ electronic protected health information (ePHI). When healthcare practices, therapists, and medical consultants use cloud software, HIPAA mandates that the vendor sign a Business Associate Agreement (BAA) and implement complex cloud security controls.

Oyma operates under a fundamentally different paradigm: it is an offline, local-first macOS application that operates exclusively on your device.

Clarification on Certification and BAAs

It is critical to understand the distinction between cloud service providers and local desktop software:

• No Business Associate Agreements: Because Oyma operates zero cloud infrastructure, servers, or hosted databases, we do not access, process, or store your patient data. Consequently, Oyma does not enter into Business Associate Agreements (BAAs).
• No Third-Party Compliance Badges: Oyma does not claim formal third-party HIPAA certification badges. Compliance is an organizational responsibility that depends on how you manage your hardware, encryption, and operational practices.

How Local Architecture Protects Clinical Data

For practitioners evaluating Oyma for clinical notes, consultations, or therapy logs, the local architecture offers substantial security advantages over cloud platforms:

1. Zero Data in Transit: Clinical notes, patient transcripts, and meeting summaries are never transmitted across the public internet to third-party cloud servers.
2. On-Device Whisper Processing: Consultations recorded with patient consent are transcribed locally on your Mac’s Apple Neural Engine. Patient voice audio never leaves your physical hardware.
3. Device-Level Protection: When paired with macOS FileVault full-disk encryption and strong endpoint security policies, clinical notes remain protected behind hardware-level XTS-AES-128 encryption.
4. Network Auditing: Security compliance officers can use the built-in Network Egress Monitor to verify that zero external network packets are dispatched during clinical sessions.

+-----------------------------------------------------------+
|            HIPAA Clinical Data Flow in Oyma          |
|                                                           |
|   [Patient Consultation]                                  |
|            |                                              |
|            v (With explicit patient consent)              |
|   [Apple Silicon Neural Engine: Local Whisper]            |
|            |                                              |
|            v (Local file write)                           |
|   [macOS Encrypted APFS Volume: FileVault XTS-AES-128]    |
|                                                           |
|          (ZERO CLOUD TRANSMISSION / ZERO BAA RISK)        |
+-----------------------------------------------------------+

Healthcare organizations must ensure that physical devices running Oyma comply with standard HIPAA workstation security standards, including automated screen locking, strong passwords, and encrypted backups.

Healthcare Compliance Invariants and Operational Guidance

Healthcare practitioners and covered entities evaluating Oyma:

• Local Machine Boundary: Because Oyma operates locally and maintains zero cloud infrastructure, patient data never traverses external vendor servers.
• Device Security Controls: Organizations must ensure physical Mac workstations enforce FileVault encryption, strong account passwords, and automated screen lock timeouts.
• Zero Vendor BAA: Because Oyma does not host, process, or transmit electronic patient records on remote servers, we do not issue Business Associate Agreements (BAAs).
• Network Egress Verification: Clinical compliance teams can use the built-in Egress Monitor to verify that zero network bytes leave the machine during patient consultations.