Standards and certifications
Standards, scope and status.
Implemented, built to, certification underway and migration underway are different positions. Each is stated precisely.
Public register
A clear position for every standard.
The table separates implemented capabilities from architecture criteria and formal certification or assessment work.
| Standard | Scope | Status |
|---|---|---|
| AES-256-GCM encryption at rest | All patient data | Implemented |
| GDPR Articles 15, 17, 20 | Access, erasure, portability | Implemented |
| HL7 FHIR R4 | Import and export | Implemented |
| HIPAA technical safeguards | Access control, audit, integrity, transmission security | Built to |
| SOC 2 Trust Services Criteria | Security, availability, confidentiality | Built to |
| ISO 27001 | Information security management | Certification underway |
| ADHICS | UAE healthcare information security | Assessment underway |
| NIST FIPS 203 / 204 | Post-quantum cryptography | Migration underway |
How to read the register
The status is part of the claim.
Implemented identifies an operating platform capability. Built to identifies architecture aligned to named criteria. Underway identifies active certification, assessment or migration work.
Formal certification is stated only when the corresponding certificate exists.
Scope matters
Obligations follow role, market and deployment.
An individual product, research environment, clinic integration and government deployment can place Shiora in different legal roles. Institutional review maps the applicable obligations to that deployment.
Review your scope