Data Compliance
NXi Systems — Nexus. Last updated 25 July 2026.
This page describes the specific safeguards Nexus implements, in the language of the rules they answer to. It is written to be checkable — each item corresponds to something implemented in the system, not an aspiration.
Scope: what makes this PHI
A referral records that an identifiable individual sought or received a service. That is protected health information even with no clinical content attached, so HIPAA and the California Confidentiality of Medical Information Act (CMIA) apply to Nexus in full.
Data minimization (HIPAA §164.502(b), minimum necessary)
- No patient or plaintiff name, date of birth, SSN, medical record number or address is stored. No column exists to hold one.
- A referral's subject is a keyed, provider-scoped cryptographic handle derived from the referring provider's own client identifier. It is not reversible by Nexus.
- The handle is derived per provider, so two providers using the same internal identifier do not resolve to the same subject.
- No clinical record is stored, at any point, in any form.
Authorization for disclosure (HIPAA §164.508; CMIA §56.11)
- Authorization is captured when the referral is created, as a required part of that operation — not as a later step that could be skipped.
- Each authorization is scoped to named providers, a named service, and an expiry.
- Revocation is a first-class state. A revoked authorization is retained as history — it is never deleted — and it immediately stops new grants and invalidates outstanding ones.
- No live, in-scope authorization means no grant is issued. This check fails closed: if it cannot be verified, it is refused.
Accounting of disclosures (HIPAA §164.528)
- Every authorization event — issued, redeemed, denied, revoked — writes a permanent record.
- That record is append-only: it is never updated and never deleted, it has no modification timestamp, and it deliberately has no foreign keys, so it survives the removal of the referral, authorization or provider it describes.
- The record is written before the grant is released, so a usable grant cannot exist without its disclosure entry.
- Retention of this record is not subject to routine cleanup.
Automatic logoff (HIPAA §164.312(a)(2)(iii); CMIA §56.101)
- Staff sessions expire after a short period of inactivity (15 minutes by default, the CMIA ceiling), enforced on the server.
- Sessions also carry a hard maximum lifetime that activity cannot extend.
- The browser warns before an idle timeout and clears the screen when it fires; the server, not the browser, is the authority.
Access control (HIPAA §164.312(a)(1), §164.312(d))
- Staff authenticate with email plus a time-based one-time code. No passwords are stored and there is no password code path.
- A one-time code cannot be used twice; reuse is detected and refused.
- Repeated failed attempts lock the account temporarily. Lockouts and the reuse guard are held in the database, so they survive a restart and apply across all instances — they are not held in a cache that could clear.
- Disabling a staff account terminates its live sessions immediately, not merely its ability to sign in again.
- Provider credentials are bound to one provider. A provider may read the public directory and only its own referrals, authorizations and grants.
Transmission and integrity (HIPAA §164.312(e))
- All traffic is served over TLS, with HSTS enabled in deployed environments.
- Grants are short-lived, single-purpose and use-limited. Only a hash of a grant is stored, so a database read yields no usable grant.
- Signed inbound events are verified over their exact original bytes with a constant-time comparison and a freshness window.
Error reporting and PHI
- Diagnostics forwarded off the system are scrubbed of identifiers — email addresses, dates, long digit sequences and token-like values — on both the browser and server sides.
- URLs are reduced to their path before being reported, so an identifier in a query string cannot leak through diagnostics.
Browser hardening
- A Content Security Policy permits scripts only from this origin, with no inline script and no dynamic evaluation. The console loads no third-party code and no external fonts or analytics.
- Session cookies are HttpOnly and SameSite=Strict, and Secure in deployed environments, so page script cannot read a session token.
- Framing is denied and referrers are suppressed.
Deliberately out of scope
Nexus does not offer record storage or store-and-forward delivery. Adding it would make Nexus a repository of clinical information and would change the analysis on this page substantially. It is excluded by design, not omitted by oversight.