Connexure Keeps PHI Out of Jira With a Files.com Handoff

Connexure builds the software the US medical stop-loss market runs on. Carriers use it to underwrite and administer stop-loss policies, brokers use it to shop and place coverage, and third-party administrators use it to file and track claims against those policies. Its whole pitch to that market is connection: keeping carriers, brokers, and TPAs in sync through software, so member data stops traveling by email.

Everything in that market is claims data, and a stop-loss claim is a person: a name, an employer, a diagnosis, a dollar amount. Roughly ninety client organizations, including some of the largest health insurers in the country, run their stop-loss business through Connexure's products. So when one of those clients hits a problem in the software, the evidence of the problem is usually an image of exactly that data.

A Bug Report That Contains a Diagnosis

Client issues arrive through HubSpot, Connexure's client-facing support system, and they arrive with attachments. Reproducing what a client saw usually means looking at the claim the client was looking at, and a claim identifies a person. A single screenshot can carry a member's name, their employer, and their diagnosis. That is PHI, riding on a support ticket.

The people who fix those issues work in a different system. Engineering runs in Jira, an ALM that Connexure deliberately keeps outside HIPAA scope, so its engineering toolchain never has to be defended as a system that holds member health data. But HubSpot and Jira were integrated so that tickets could become engineering work, and that integration was the leak. PHI-bearing attachments had slipped through it into Jira before. The one path between support and engineering was the one path the data must not take.

That put the customer solutions team in a bind on every ticket that needed an engineer. Hold the material back, and the engineer cannot reproduce the issue while a payer client waits on the fix. Pass it along, and it lands in a system that was never supposed to hold it.

Every Available Path Broke a Rule

The problem persisted because both boundaries around it were correct. Bringing Jira into HIPAA scope would drag the entire engineering toolchain into compliance audits for the sake of ticket attachments. Opening the support system to engineers was ruled out just as firmly.

“We don't want the engineers in there accidentally, it's just separation of church and state, if you will.”

The workaround clients reached for defeated itself. Hearn described what happened when clients tried on their own to send sensitive material safely:

“They're doing it so it's secure, but in order to actually view the information, we have to share a password. So either way, we're kind of violating the protocols on either side.”

What the fix had to do was clear. It had to sit between the two systems while changing neither. It had to work per ticket rather than per client, a requirement CTO Ryan Kowieski set on containment grounds:

“If somebody got access to that link, which is everything for that client, that would be really, really bad. If it was dynamic, and it's access to a single file, that's bad, but maybe contained.”

And it had to carry the compliance answer itself: HIPAA with a signed BAA, SOC 2, and a record of who put each file in and who took it out.

Connexure selected Files.com to be that channel, the compliant layer between its ticketing system and its ALM.

Files.com Between the Ticket and the Fix

Files.com became the place where the regulated payload actually lives. The systems on either side carry only references to it.

When a ticket needs engineering, the customer solutions team moves its screenshots and videos out of HubSpot and into a Files.com folder scoped to that ticket. The Jira issue references the folder instead of holding attachments. Engineers open the material in Files.com, reproduce what the client reported, and work the fix in Jira, which never touches the data. Because each handoff gets its own folder, an exposed link would expose one ticket's files, not a client's history. That is Kowieski's containment requirement, built directly into the folder structure.

The channel also carries the compliance load neither endpoint could. Files.com runs under HIPAA with a BAA and SOC 2, group permissions decide who can read and write each folder, and every upload and download is written to an audit log. Access follows identity Connexure already manages: employee accounts are provisioned into Files.com automatically from Microsoft Entra ID, so an engineer's access to the channel tracks the directory rather than a list somebody maintains.

PHI Out of the ALM, on Every Ticket

With the handoff in production, Connexure closed the one route by which PHI had been reaching its engineering system, and did it without weakening either of the boundaries that made the problem hard.

• PHI is out of the engineering ALM. Jira carries a reference to the regulated material, never the material itself, and stays outside HIPAA scope as a matter of architecture rather than vigilance.
• Engineers reproduce client issues from the actual screenshots and videos without ever entering the client-facing support system.
• Moving regulated troubleshooting material is routine workflow rather than exception handling, with the same per-ticket pattern applied every time.
• Every movement of that material is on the record. Uploads and downloads land in the Files.com audit log under a HIPAA BAA and SOC 2, the kind of answer Connexure's payer clients ask for in security reviews.

The pattern also costs nothing to extend. A new client or a busier support queue adds no new compliance surface, because the next handoff is one more folder in the same channel, governed by the same permissions and the same log.

Two Boundaries, Kept

Connexure never brought Jira into HIPAA scope, and never opened HubSpot to engineering. The regulated payload got its own compliant channel in Files.com, and everything else moves by reference. For a company that sells the stop-loss market on taking member data out of email between counterparties, the handoff between its own support and engineering teams now runs on the same principle its products do.