Running a MEWA’s plan means holding enrollment and filing data for thousands of people, and never their clinical or claim-level data. Protecting what we do hold is part of doing the work, not a feature bolted on.
We hold only what the plan needs, keep it under a formal agreement, and protect it with the controls, infrastructure and discipline that go with it.
Enrollment, census and filing data, plus the aggregate benefit payments the plan’s own books and its Schedule H require. Never a diagnosis, never a clinical record, and never claim-level detail about any member. The data we never collect is data that can never be exposed, which makes this the strongest safeguard we have.
Mewa.io operates as a HIPAA Business Associate and signs a BAA with every plan it serves. The data we do hold is handled under its terms.
People reach data only when their work requires it, granted by role, never by default, with staff access behind multi-factor sign-in. Separation between plans is enforced by the database itself, on every request. If that check ever fails, the result is an empty screen, never another plan’s data.
Data is protected on the way in and while it sits, so it stays unreadable if it is ever intercepted or reached at the storage layer.
Access to a plan’s data is logged, who reached what, and when, so there is always a record of who has touched the plan’s information.
The platform runs on Amazon Web Services, whose infrastructure is independently certified to SOC 2 and ISO 27001. The physical and network security underneath everything above.
Plan data is backed up and recoverable, so a hardware failure or an honest mistake never puts a filing season at risk.
The plan’s accounting and filing record belong to the plan, retrievable and not locked in. You sign every filing with your own credentials.
Your data runs your plan and the Market Insights drawn from it. Nothing else, and it is never sold.
Security questions are welcome, including from your own IT or privacy officer. Ask the direct question, and you’ll get a direct answer.
Leave your email and we’ll answer the specific questions your IT or privacy review needs answered, in writing. Send the questionnaire if you have one.
Or email us directly.