Defined Roles Across the Care Team
Staffing location, qualifications, access, supervision, and responsibilities are confirmed during implementation. Activities requiring U.S.-based or licensed personnel are assigned accordingly. Philippines-based personnel are limited to permitted nonclinical and administrative functions within client-approved workflows.
Security Practices Built Into the Workflow
Every engagement starts with a defined security model for people, systems, data, and workflow ownership. Those controls are documented during implementation in the client agreement, BAA, system-access plan, and operating procedures.
HIPAA-Aligned Operations and BAAs
Workflows are designed to support HIPAA-aligned handling practices. Business Associate Agreements are available when the engagement requires access to protected health information.
Role-Based Access
Access is assigned according to role, minimum-necessary workflow needs, approved systems, and client-specific responsibilities. Access changes and removal follow documented procedures.
Workforce Training
Team members receive training on confidentiality, PHI handling, approved communication channels, incident reporting, escalation, and the procedures relevant to their assigned work.
Approved Communication Channels
Sensitive client and patient information is exchanged only through approved systems and channels established for the engagement, not public website forms or ordinary marketing inquiries.
Incident Reporting
Workforce members follow documented reporting and escalation paths for suspected security, privacy, access, or workflow incidents. Contractual notification requirements are handled under the applicable agreement.
Secure Documentation Workflows
Care-management documentation uses approved systems, defined access, workflow traceability, quality review, and retention practices aligned to the applicable program and client environment.
Business Continuity
Continuity planning addresses critical workflows, communication, staffing, systems, escalation, and recovery responsibilities so disruptions can be managed in a controlled manner.
Independently audited information security
A Global Standard for Information Security
CF Solutions Philippines Inc., the Philippine operating entity supporting CF Care Connect delivery, is certified to ISO/IEC 27001:2022 under certificate PH26/00000076.
ISO/IEC 27001:2022 is the globally recognized standard for information security management systems. Certification requires independent audit of a structured, risk-based security program and ongoing surveillance that keeps continual improvement active over time.
Certificate PH26/00000076 documents the certified entity, location, activities, and scope.