Is Oli Health ISO/IEC 27001:2022 Certified?

Yes. Oli Health is ISO/IEC 27001:2022 Certified. ISO develops the standard; an independent certification body issues the certificate. Contact our security team to request the certificate, including its issuer, validity period, and certification scope.

Is Oli Health HIPAA Compliant?

Yes. When Oli Health handles protected health information for a covered-entity customer, we act as its HIPAA Business Associate. BAA information is available for U.S. healthcare customers.

Does Oli Health Support Canadian Privacy Requirements?

Yes. Oli Health maintains safeguards designed for PIPEDA and applicable provincial health-information requirements. Canadian infrastructure options support practices with regional data requirements.

How Does Oli Health Protect Patient Data?

Production data is encrypted at rest and in transit. Access is role-based, administrative production paths are secured, credentials use managed secret storage, and production access is logged.

How Does Oli Health Approach Disaster Recovery?

We maintain documented disaster recovery and incident procedures, run automated daily backups, and test restore integrity. Critical production systems use 24-hour recovery-time and recovery-point targets.

Can My Practice Request Security Documentation?

Yes. Email security@olihealth.ai to request the ISO/IEC 27001:2022 certificate, BAA information, or detailed security and compliance materials for your review.

ISO/IEC 27001:2022 Certified

Trust Is Not a Feature. It Is the Foundation.

Oli Health protects sensitive health information through an ISO/IEC 27001:2022 Certified security management system, healthcare privacy safeguards, and controls designed into every layer of the platform.

Get Started Free Request Security Documents

Assurance Overview

Security at a Glance

Identity

Role-based access

Data

Encrypted by default

Accountability

Production access logged

Resilience

Disaster recovery tested

Independent Assurance: Oli Health is ISO/IEC 27001:2022 Certified.

Verified Foundations

Standards That Match the Stakes of Healthcare

Certification and privacy obligations serve different purposes. Together, they create an accountable system for managing security risk and protecting health data.

HIPAA
Compliant
United States
PIPEDA
Compliant
Canada
ISO/IEC 27001:2022
Certified
Information Security Management Systems (ISMS)

ISO/IEC 27001:2022 Certified

Security Managed as a System, Not a Checklist

ISO/IEC 27001:2022 defines the requirements for an information security management system. Oli Health’s ISO/IEC 27001:2022 Certified status demonstrates that security risk is governed through a structured, continually improving program spanning people, process, and technology.

Risk-based control selection
Clear security ownership
Internal review and improvement
Independent certification audit

ISO develops the standard but does not issue certificates. Oli Health’s certificate is issued by an independent certification body. Request the certificate for issuer, validity, and scope details.

Defence in Depth

Controls Across the Security Lifecycle

Good security connects governance to daily operations. These layers work together so protection does not depend on any single control.

Govern

Risk-Led Security Management

Our ISO/IEC 27001:2022 Certified information security management system turns security into an operating discipline—with ownership, risk assessment, review, and continuous improvement.

Defined control ownership
Vendor security reviews
Documented policy lifecycle

Protect

Layered Data Protection

Encryption, managed secrets, role-based access, and secure administrative paths protect health information throughout the service lifecycle.

Encryption at rest and in transit
Minimum-necessary access
Managed production pathways

Detect

Accountable Operations

Logging, monitoring, vulnerability management, and access reviews create visibility across the production environment.

Production access logging
Security event monitoring
Regular access reviews

Recover

Resilience by Design

Documented disaster recovery procedures, automated daily backups, restore-integrity testing, and recovery targets prepare Oli Health to respond when reliability matters most.

Automated daily backups
Disaster recovery procedures
Restore-integrity testing

Regional Privacy

Built for Practices on Both Sides of the Border

Your regulatory context matters. Oli Health pairs shared security controls with safeguards and infrastructure choices for U.S. and Canadian practices.

United States

HIPAA & HITECH

Oli Health acts as a Business Associate when handling protected health information for covered-entity customers, with BAA support for U.S. healthcare practices.

Business Associate safeguards
Security and Privacy Rule controls
Breach-response procedures

Canada

PIPEDA & Provincial Privacy

Privacy controls support Canadian practices navigating PIPEDA and applicable provincial health-information requirements, including regional infrastructure options.

Canadian privacy safeguards
Consent-aware data handling
Canadian infrastructure options

Operational Safeguards

Security That Works Quietly in the Background

Secure Access

Role-based permissions and protected administrative paths.

Data Protection

Encryption, managed secrets, automated daily backups, and restore tests.

Vendor Governance

Diligence, contract review, and minimum-necessary data access.

Cloud Resilience

Managed infrastructure with monitoring and documented disaster recovery planning.

Explore the Trust Center

Frequently Asked Questions

Have more questions? Contact our support team.

Ready to Transform Your Practice?

Join thousands of practitioners who trust Oli Health to streamline their workflow and deliver exceptional care.

Get Started Free