Advanced Data Protection Addon
Advanced Data Protection
Department-level encryption for the fields that carry PHI and PII. Your department gets its own encryption key, held in a key management service kept away from the Resgrid database, protected values are encrypted before they touch that database, and revealing them requires a fresh MFA step-up. Required for Resgrid to sign a HIPAA Business Associate Agreement.
Call #2026-04817
Priority Emergency
Status Dispatched
Unit Engine 1
Nature [ Protected ]
Address [ Protected ]
Contact [ Protected ]
Reveal requires MFA step-upWhat Every Department Already Gets
Advanced Data Protection is not the first line of defense — it is an extra one. Every Resgrid department, on every plan, free tier included, already runs on these three controls at no additional cost.
Encryption at Rest
Every Resgrid database, file, and volume lives on self-encrypting drives (SEDs) in our SAN. A disk that is pulled, swapped, decommissioned, or stolen is unreadable once it leaves the array.
Encryption in Transit
Every connection — browser to site, mobile app to API, and our own services to each other — runs over SSL/TLS. Nothing about your department crosses a network in the clear.
Encrypted Backups
Backups and snapshots are encrypted as well, so the disaster-recovery copies of your data carry the same protection as the live system rather than becoming the soft target.
Where that baseline stops
Those three controls defeat someone who takes the media: a pulled drive, an intercepted connection, a lifted backup. They cannot help once the storage is mounted and the platform is running. To a live database, a self-encrypting volume is simply a readable disk, and any query, export, log line, workflow, or notification that touches a record sees that record in full. Advanced Data Protection closes that gap by encrypting the sensitive fields themselves, under a key that never lives on the application servers and is only unwrapped for an authorized user who has just passed an MFA step-up.
In transit
Included with every plan
SSL/TLS on every connection
Stops: Interception on the wire
At rest
Included with every plan
Self-encrypting drives in the SAN
Stops: A pulled or decommissioned disk
Backups
Included with every plan
Encrypted snapshots and backups
Stops: A lifted backup or restore copy
Field level
Advanced Data Protection addon
Per-department keys, held off the database, MFA-gated on every reveal
Stops: A readable database dump, a stray log line, an over-broad query, an unattended screen
Each layer covers what the one above it cannot. Adding the addon does not replace anything below it — your data keeps every baseline protection and gains field-level encryption on top.
What the Addon Adds on Top
Encryption at the field level, authorization at every reveal, and redaction on every unattended path out of the platform.
Per-Department Encryption Keys
Your department gets its own data encryption key. It is never derived from a password, a department number, or a value in our source code, and it is only ever stored wrapped by a key-encryption key that lives in a separate key management service.
Field-Level, Not Just Disk-Level
Protected values are encrypted before they are written to the database, the queue, the cache, and the backup. Self-encrypting drives protect a disk that leaves the array; this protects the record itself from a dump, a replica, an export, or a log line.
Step-Up MFA on Every Reveal
Reading or writing a protected field requires a short-lived Protected Data Grant issued after a fresh MFA check. A stolen session token on its own is not enough to reveal patient or personnel data.
Redacted by Default Everywhere Else
Workflows, automation, logs, telemetry, dead-letter queues, and the unattended BigBoard display receive redacted projections. They never receive protected plaintext, and never raw ciphertext.
Notification Egress Control
Push, email, SMS, and voice are four independent choices, and every one of them defaults to a generic notice telling the recipient to sign in to Resgrid. Releasing content to a channel is a deliberate, acknowledged decision.
Minimum-Necessary Support Access
For a protected department, Resgrid support tooling is metadata-only. Our staff can see envelope versions, sizes, identifiers, and correlation data, not your plaintext, without a separately authorized and audited disclosure process.
Where Your Keys Live
Encryption only helps if the keys are somewhere the encrypted data is not. Your department key, the key that wraps it, and the key that unlocks that service are each held apart from the database and from each other.
- 1
Ciphertext moves in and out of the database
The application reads or writes the protected record, but every protected field is an encrypted envelope. Nothing in the database, a replica, a queue, or a backup is readable on its own.
- 2
The application hands the field and the grant to the broker
After normal permission checks and a fresh MFA step-up, the app sends only the required fields plus the short-lived Protected Data Grant. The app itself has no key material.
- 3
The broker asks the key service to unwrap that department's key
The broker validates the grant, the department binding, and replay state first. The unwrap request is bound to your department, so another department's context cannot unwrap your key.
- 4
The key comes back into broker memory only
The key-encryption key never leaves the key service, and the unwrapped department key never reaches the application tier, the database, or disk. It is discarded after the operation.
- 5
The broker encrypts or decrypts and returns the result
On a write it returns a sealed envelope for storage. On a read it returns plaintext to the authorized, attended client for the life of that grant, and nothing else.
Steps 2 through 5 run on every reveal and every protected write. When you first enroll, your existing records are converted by an overnight migration job rather than a live conversion, so a long history encrypts in the background.
Envelope Encryption, Bound to Your Department
Advanced Data Protection uses per-department envelope encryption. A random 256-bit data encryption key belongs to your department and is stored only in its wrapped form. The key-encryption key that wraps it lives in a separate key management service, backed by FIPS 140-3 validated cryptography, which exposes wrap and unwrap operations only and never a key export. Production web, API, and worker hosts hold no key material at all.
- AES-256-GCM authenticated encryption on every protected value
- Additional authenticated data binds ciphertext to your department, record, entity type, and field
- Ciphertext moved between departments, records, or fields fails authentication instead of decrypting
- Key-encryption key held by a dedicated key management service backed by FIPS 140-3 validated cryptography
- Versioned envelopes support key rotation without ever exposing plaintext key material
- Key management outages fail closed, so protected data is never silently overwritten with blanks
The Protected Data Grant
Normal permissions are still required, but they are no longer sufficient. To reveal or edit a protected field, a user must complete a fresh MFA step-up and receive a short-lived grant bound to one user, one department, one application, one session and device, and one policy version. The grant never contains a key, and a dedicated broker validates it before any decryption happens.
- Fresh TOTP, passkey/WebAuthn, or federated MFA required before a grant is issued
- Step-up window is department-configurable, defaults to 15 minutes, and is an absolute lifetime
- Windows longer than 60 minutes require a second confirmation and a recorded reason
- Role, membership, or policy changes immediately revoke outstanding grants
- A Dispatch grant cannot be replayed by BigBoard, a workflow worker, or another department
- API keys, service accounts, and background jobs can never obtain a user grant
A Reviewed Catalog of What Gets Protected
Protection follows a versioned, code-reviewed field catalog rather than a blanket sweep. Calls, call notes and logs, attachments, patient and clinical records, personnel identifiers and certifications, contacts, incident command records, forms and user-defined fields, and moderation originals are protected. Database keys, foreign keys, lifecycle states, and timestamps stay plaintext so routing, relationships, and integrity still work.
- Calls: nature, notes, address, location, contact name and number, reference numbers, form data
- ePCR: patient identity, demographics, narratives, vitals, medications, procedures, signatures
- Personnel: member identifiers, license and certification numbers, department-scoped contact details
- Contacts, incident command records, documents, attachments, and generated reports
- Structural fields stay readable so dispatch, assignment, and relational integrity keep functioning
- The protected-data shield only appears after your department's migration is verified
Redaction on Every Unattended Path
The hard part of protecting sensitive data is not the database, it is everything that copies data out of it. Advanced Data Protection redacts protected values before they reach automation, unattended screens, or third-party providers, and the platform is tested with synthetic canaries that fail the build if a protected value reaches a log or telemetry sink.
- Workflows receive the literal placeholder REDACTED plus structured redaction metadata
- BigBoard shows a safe shell of call number, priority, status, and assigned unit, with no grant or ciphertext
- Notifications default to a generic sign-in prompt on push, email, SMS, and voice
- SMS and voice can optionally release an approved subset only after a Resgrid PIN challenge
- Queue, retry, and dead-letter failures log identifiers and result codes, not message bodies
- Every protected read, write, and denial produces a value-free audit event
Self-Service Enrollment, Overnight Migration
Turning protection on is your decision, not a sales conversation. Subscribe to the Advanced Data Protection addon from your billing settings, complete the enrollment wizard, and the platform provisions your department key and begins migrating your existing records. That migration runs as an overnight job rather than a live conversion, so a large history is encrypted in the background instead of holding your department offline.
- Add the addon and pay for it yourself from your billing settings
- Enrollment wizard requires a department administrator with recent MFA
- The wizard records exactly what you are accepting before anything changes
- Your department key is provisioned and existing records are queued for migration
- Migration runs as an overnight job, so nothing stalls waiting on a live conversion
- The protected-data shield appears once that catalog version's migration is verified
Required for a HIPAA Business Associate Agreement
Resgrid will sign a HIPAA Business Associate Agreement only for departments with Advanced Data Protection enabled. The controls this addon provides, including field-level encryption of PHI, step-up authentication, minimum-necessary support access, egress control, and value-free audit, are the technical safeguards that make that commitment possible. Advanced Data Protection is included with the Resgrid ePCR package.
- Advanced Data Protection is a precondition for Resgrid signing a BAA with your organization
- Included with the Resgrid ePCR package to protect patient care records
- Follows the HIPAA minimum-necessary principle for all Resgrid support access
- Non-routine access is individually scoped, reason-captured, notified, and reviewed
- Append-only, hash-chained audit trail across identity, application, broker, and key management
- Contact Resgrid to start the BAA process once the addon is active on your department
Advanced Data Protection Pricing
Advanced Data Protection is a per-department addon billed yearly, even if your department is on a monthly subscription. Adding or removing it does not change your main subscription.
North America (Worldwide)
$1,950 /yr
per department, billed yearly
Europe (EU-Central)
€2,550 /yr
per department, billed yearly
Enrollment is self-service. Subscribe to the addon, run the enrollment wizard, and your existing records are encrypted by an overnight migration job.
What Advanced Data Protection Does Not Do
Security features are only useful if you know their edges. These are the documented limits and tradeoffs you accept when you enable protection.
It is not end-to-end or zero-knowledge encryption
Authorized Resgrid components must handle plaintext long enough to display or update it. A compromised application serving a live, authorized session could observe plaintext during that grant window.
Encrypted fields cannot be searched or sorted
Randomized ciphertext cannot support wildcard search, full-text search, sorting, grouping, analytics, or workflow matching. Search without a grant returns safe metadata, and revealing a result rechecks authorization for that record.
Metadata can still be sensitive
Identifiers, membership, assignment, priority, status, counts, and timestamps stay plaintext by design. They remain access controlled, but they can still reveal operational facts even when narratives are encrypted.
It does not retroactively protect what already left
Messages, exports, reports, backups, and third-party copies created before enablement are not rewritten. A PIN gate on SMS or voice does not encrypt carrier SMS or spoken audio.
Existing data is encrypted overnight, not instantly
Enrollment provisions your key immediately, but your existing records are converted by an overnight migration job. Until that catalog version's migration is verified for your department, the protected-data shield is not shown for those records.
Turning protection off is not a casual toggle
Protection is opt-in per department. You can turn it off, but reversing an enrolled department is a deliberate, audited operation, and the warnings in the wizard about search, export, and integration limits apply for as long as it is on.
The addon alone is not compliance
This is a defense-in-depth technical control. HIPAA, ePCR, and NEMSIS outcomes also depend on your configuration, identity policy, contracts, workforce practices, retention, incident response, and independent assessment.
Consistent Across Every Resgrid Application
Attended apps prompt for a step-up and show protected values to authorized users. Unattended surfaces are stepped down to safe projections that egress policy can never relax.
Core Web
Dispatch
Responder
Unit
IC Command
BigBoard
Workflows
REST API
Ready to Protect Your Department's Data?
Advanced Data Protection is opt-in and self-service. Add it to your plan, run the enrollment wizard, and contact us when you are ready to start the HIPAA Business Associate Agreement process.
AES-256-GCM
Field Encryption
FIPS 140-3
Validated Key Service
15 min
Default Step-Up Window
HIPAA BAA
Eligibility Requirement