Access Control

Implement technical policies and procedures for electronic information systems that maintain electronic protected health information to allow access only to authorized persons or software programs.

Enable SAML SSO: Coda supports open standard SAML 2.0 and can work with your Identity Provider (IdP) of choice. For organizations managing multiple workspaces, Coda’s SAML implementation supports provisioning access to specified workspaces based on IdP user attributes.
​

Packs control: All integrations and Packs can be configured to be disallowed or require admin approval prior to installation. Coda’s Packs platform also provides advanced configurations for admins to control data schemas/type allowed in Packs.
​

Personal access tokens: Personal access tokens can be disabled at the organization level by Coda Support.

Unique User Identification

Assign a unique name and/or number for identifying and tracking user identity.

SAML/SCIM: In addition to SAML login, Coda has a SCIM API allowing admins to provision, manage, and deprovision members directly from their IdPs.

Automatic Logoff

Implement electronic procedures that terminate an electronic session after a predetermined time of inactivity.

Session period: Coda’s default session period is 30 days. Customers who require a different session period may reach out to Coda support to set a custom session timer.

Audit Controls

Implement hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use electronic protected health information.

Audit log: Coda has an in-product Audit log dashboard that lists the audit events for your organization.
​

Admin API: Coda offers an Admin API that can be used to integrate with your preferred SIEM (Security Information and Event Management) system. Coda retains these audit events for a year. Customers may use the Admin API to store logs in their preferred SIEMs for longer durations.

Integrity Controls

Implement policies and procedures to protect electronic protected health information from improper alteration or destruction.

Implement electronic mechanisms to corroborate that electronic protected health information has not been altered or destroyed in an unauthorized manner.

Implement security measures to ensure that electronically transmitted electronic protected health information is not improperly modified without detection until disposed of.

Audit Log: Audit logs provide an immutable record of events within a organization.
​

Admin API: The Admin API allows users to integrate with external services for customers who require custom retention and/or backup of their logs.
​

Sharing restrictions: Admins may set sharing restrictions and can prevent external sharing entirely. This includes the ability to enable/disable publishing of docs.
​

Folder permissions: All folders are set to private by default upon creation.
​

Legal holds: Available as a paid add-on. This feature allows admins to place legal holds on users and preserve their docs for a specific amount of time.
​

Workspaces: Admins may restrict the creation of new workspaces from their users.
​

Data Export: Admins may configure the ability for users to export their documents. Admins may export their organization’s data and any time.

Transmission Security

Implement a mechanism to encrypt electronic protected health information whenever deemed appropriate.

Implement a mechanism to encrypt and decrypt electronic protected health information.

Encryption: Coda uses the AWS Key Management Service (KMS) to create, maintain, and rotate encryption keys. Data transmitted between customers and Coda’s service is protected using TLSv1.2 or higher. Data at rest is encrypted using AES-256 symmetric encryption algorithm

Data Retention and Disposal

Implement policies and procedures to address the final disposition of electronic protected health information, and/or the hardware or electronic media on which it is stored.

Data retention and disposal: Deleted documents are kept in our primary storage systems for 7 days to allow for accidental deletions to be reverted. After this 7-day period, they are permanently removed from our primary storage systems.

Deleted data will still be retained in backups for 35 days. Once this 35-day retention period is over, the customer data will no longer be present in the backups.