OpenJDK for healthcare
The HIPAA Security Rule is technology-neutral, which is usually described as flexibility. In practice it means the Rule tells you the outcome and leaves you to prove you reached it.
The dump that holds your patients
45 CFR 164.312(a)(2)(iv) asks you to encrypt ePHI. You did. The database is encrypted, the volumes are encrypted, the backups are encrypted, and your auditor ticked the box.
Then a JVM in your clinical system hits an OutOfMemoryError and writes a heap dump. That file contains the live object graph: patient names, diagnoses, identifiers, whatever your service was holding in memory at that instant, in cleartext, on disk. None of your encryption touched it, because the value was live in memory at the moment of the write, and storage-layer encryption governs storage.
The same is true when the VM crashes and writes a fatal-error log, and when a Flight Recorder file captures an exception message with a record in it.
Your options today are to disable the diagnostics, which throws away the evidence you need when a clinical system fails, or to scrub the file afterwards, which acts on a file that already contains the ePHI. The disclosure has already happened by the time an external tool can act, because the writer is native, it is inside the process, and it emits cleartext as the stream is written.
Eliya redacts at the serialisation boundary, inside the VM. Targeted at 25.0.4.
Diagnostics that never leave your environment
Eliya sends nothing outward. No telemetry. No SaaS dependency. No callback.
Every diagnostic artifact a JVM produces (heap, JFR, GC, crash log) stays inside your environment by design, not by configuration you have to remember to apply. There is nothing to review in a data-processing agreement, because there is no processing, and there is no third party.
For a covered entity or a business associate, that is not a feature. It is the absence of a conversation you would otherwise have to have with your privacy officer, your legal team, and eventually a regulator.
What HIPAA asks that a wrapper cannot answer
The Security Rule names outcomes rather than mechanisms, so the technical safeguards at 164.312 map cleanly onto the same runtime controls that PCI exercises. That is why the concepts in our knowledge base are shared across both.
| Safeguard | The control | Why the outside cannot close it | Eliya |
|---|---|---|---|
| 164.312(a)(2)(iv) encryption and decryption | ePHI never reaches a diagnostic artifact in cleartext | The writer emits as it streams. An external scrubber only ever opens a file that already holds the record. | 25.0.4 |
| 164.312(b) audit controls | The audit trail cannot be silenced or suppressed from inside the process | A SIEM seals what it received, and cannot detect a record suppressed before it left the host. Absence looks exactly like "nothing happened". | 25.0.7 |
| 164.312(c)(1) integrity | The record that arrives is the record that was emitted | A chain sealed at emission, inside the process, turns suppression into a detectable gap. A collector cannot vouch for what it never saw. | 25.0.7 |
| 164.312(e)(1) transmission security | The negotiated TLS result actually holds | A library can build its own SSLContext and ignore java.security. Settable from outside is not enforceable from outside. | 25.0.6 |
| 164.308(a)(1)(ii)(B) risk management | The fixed code is the code running | "Installed" is not "loaded". A scanner reads the image; shading, classloader order and an unrestarted process mean the vulnerable class can still be live. | 25.0.7 |
What we do not claim
HIPAA is mostly not a JDK problem, and we will not pretend otherwise.
Access control, workforce training, business-associate agreements, physical safeguards, breach notification, contingency planning: none of these is something a runtime can satisfy or violate. Your identity provider owns authentication. Your KMS owns key custody. Your SIEM owns retention and review. Those are the right owners and Eliya does not compete with them.
What we address is the residue: the small set of controls where the state lives inside the process, and the ePHI in a heap dump is the clearest example any auditor will ever be shown.
We also will not tell you a plan is a product. In-process redaction lands in 25.0.4. It is not shipped today. What ships today is a quarterly security cadence committed through September 2029, a signed release with an SBOM, production-readiness defaults behind one flag, and provable flag provenance.
Where healthcare sits for us, honestly
Healthcare is a strategic segment for Eliya, not a deal-blocking one. We have seeded the HIPAA Security Rule in our knowledge base for cross-standard reuse, and the runtime controls it needs are the same ones we built for PCI. We have not yet decomposed it clause by clause the way we have decomposed PCI DSS. A HIPAA profile value is reserved in the flag architecture and remains demand-gated.
If you are a covered entity or a business associate running clinical or claims workloads on the JVM, tell us which safeguard you cannot close. That is how the next round of the knowledge base gets written.
Talk to the Chief Architect about ePHI in memory. Or read the policy point, or JVM forensics vs APM.
Eliya 
Dial