United States: HIPAA, PCI DSS, SOC 2, TCPA, CCPA

#Europe and the United States on one platform

Univerx is operated by Univerx LLC, a company registered in Delaware that is active in Germany and the United States. European rules such as the GDPR are built into the platform. US customers add other frameworks to the review.

This page describes what procurement, information security and legal teams in the United States typically review, and how Univerx is designed for it. It names no certification and no attestation, because we name either only once it exists.

#Status per framework

#HIPAA: health data

The Health Insurance Portability and Accountability Act protects health information. Practices, hospitals and health plans may share it with service providers only when a Business Associate Agreement sets out the obligations.

Univerx is designed to protect such data with role rights, encryption, logging and retention periods. The Business Associate Agreement template is available on request. Healthcare shows what this looks like day to day.

#PCI DSS: secure payments

The Payment Card Industry Data Security Standard applies to everyone who handles card data. The fewer systems that touch card data, the smaller the scope of the assessment.

That is why Secure payments in the conversation keeps card data out of the call. The customer enters it on the keypad, the recording pauses, and the agent sees only the result.

#SOC 2: control report

SOC 2 is a report by independent auditors on controls for security, availability, processing integrity, confidentiality and privacy. Many US customers ask for it during procurement.

For Univerx, such a report is a goal. We will name it only once it exists. Until then, the security whitepaper and Security & availability describe which controls are in place.

#TCPA: consent in outbound

The Telephone Consumer Protection Act governs calls and text messages to consumers. It requires prior consent for autodialled or prerecorded calls, restricts calling hours and protects numbers on do-not-call lists.

Lists & consent is designed to store consent with time and source, schedule calls by the recipient's local time and check national and internal do-not-call lists before every campaign.

#CCPA/CPRA: consumer privacy

The California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives consumers rights to know, correct and delete their data and to opt out of its sale or sharing.

Univerx is designed to fulfil such requests per data type: find data, export it, delete it and enforce an opt-out across every channel. The foundations are described in Privacy.

#Sources

• HIPAA at the U.S. Department of Health and Human Services.
• PCI DSS at the PCI Security Standards Council.
• SOC 2 at the AICPA.
• TCPA and do-not-call lists at the Federal Communications Commission and donotcall.gov.
• CCPA/CPRA at the California Attorney General.