Administrative Infrastructure Designed for Security + Continuity

BAS maintains annual SOC 1 Type II and SOC 2 Type II certifications, HIPAA-aligned compliance posture, and a System Security Plan (SSP) with FedRAMP Authorization to Operate (ATO) for government-grade hosting controls. BAS is also an SSA-authorized provider for Death Master File access, supporting accurate participant record validation.

Yes. All participant data is stored and processed within the United States. BAS maintains 100% USA-based operations with no offshore data processing. MyEnroll360 access is geo-restricted to USA-based users only, and all administrative functions are handled by BAS in-house staff.

No. BAS operations are 100% in-house with no offshore support, no outsourced administration functions, and no third-party service providers handling participant data or administrative workflows. Every client engagement is supported by BAS-employed account managers, compliance administrators, billing coordinators, and enrollment specialists.

BAS protects PHI and PII through role-based access controls, geo-restricted platform access, documented data handling processes, HIPAA-aligned privacy governance, workforce security training, and ongoing infrastructure monitoring. All participant data is consolidated in a single Oracle database with structured access policies, eliminating fragmentation across separate systems that can increase data risk.

BAS maintains a documented disaster recovery plan with geographically distributed recovery infrastructure, immutable backup protections, and a 5-minute return-to-operations target. Recovery procedures are tested and validated annually to confirm operational readiness. In the event of a system failure, documented recovery procedures are followed to restore administrative continuity with minimal interruption to client service.

BAS performs annual recovery testing and validation procedures to confirm backup integrity and recovery capabilities. Backup protections run continuously, with storage replication across geographically distributed infrastructure. Annual testing validates that recovery procedures function as documented and that the 5-minute return-to-operations target is achievable under tested conditions.

BAS maintains a documented incident response framework covering preparation, detection, containment, investigation, remediation, and recovery. This framework governs how security incidents and potential breaches are identified, assessed, and addressed. Incident response procedures are part of BAS's documented security posture included in the System Security Plan and reviewed as part of ongoing compliance oversight.

Yes. BAS builds and administers secure integrations between MyEnroll360 and employer HRIS platforms, payroll systems, and insurance carriers. Integration connections are designed with controlled data exchange protocols, access logging, and oversight by BAS administrative teams. All integration activity is monitored and subject to the same security controls governing BAS operations broadly.

BAS supports business continuity through geographically distributed infrastructure, immutable backup protections, documented disaster recovery planning, annual recovery testing, and a dedicated in-house operational model. With 35+ years of operational experience and no offshore outsourcing, BAS provides stable administrative continuity that persists through client organizational changes, personnel transitions, and benefit restructuring.