Security & Compliance

Patient privacy by design. Audit by default.

AfriMed HIE is built to an open-infrastructure standard — security, patient consent, and audit are foundational, not bolted-on features.

Controls

Defense-in-depth across the stack.

Eleven user roles, facility-level partitioning, and purpose-of-use enforcement on every query.

Multi-factor authentication for clinicians, admins, and integration partners.

In transit (TLS 1.3) and at rest (AES-256). Field-level encryption for sensitive identifiers.

Patient consent checks before every data exchange, with full revocation and audit history.

Every record viewed, created, updated, exported, or shared — by user, role, facility, IP, and timestamp.

Multi-region readiness, retry queues, and dead-letter handling for guaranteed delivery.

Aligned with modern data protection law, GDPR principles, and OpenHIE security guidance.

In-country data residency options. Strong key management. No vendor lock-in.