HIPAA and NHS Considerations for Icon Map

Icon Map is a secure mapping visual for Power BI, designed to support deployment in regulated healthcare environments, including organizations subject to HIPAA in the United States and NHS governance in the United Kingdom.

This page explains how Icon Map supports healthcare compliance, data protection, and secure handling of sensitive data.

For technical detail on external resources, development practices, and assurance options, see our Icon Map Pro security whitepaper (PDF). If you use Microsoft Fabric, see Icon Map for Fabric in healthcare below.

Secure Data Architecture for Healthcare

Icon Map is built on a security-first architecture aligned with Microsoft Power BI and Microsoft 365:

• No customer data is stored or processed by Tekantis
• All data remains within the customer’s Power BI tenant
• The visual runs inside the Power BI custom visual sandbox
• No dataset contents are transmitted to external services

This architecture ensures that healthcare data, including sensitive or regulated data, remains fully controlled by the organization.

Is Icon Map HIPAA Compliant?

HIPAA does not provide formal certification. Instead, compliance is determined by how a product is used within a healthcare organization.

Icon Map is designed to support HIPAA-compliant deployments by ensuring that:

• No Protected Health Information (PHI) is transmitted outside the customer environment
• No geocoding or external processing of address data occurs
• Data remains entirely within Power BI and Microsoft infrastructure

No External PHI Exposure

Unlike many mapping tools, Icon Map does not send location or address data to external services.

External requests are limited to:

• Base map tiles
• Customer-configured services

These requests do not include dataset values or PHI.

Business Associate Agreement (BAA)

Icon Map is typically deployed in a way where Tekantis does not act as a Business Associate under HIPAA, because:

• Tekantis does not access customer data
• No PHI is stored or processed by the vendor

However, each organization determines its own requirements, and Tekantis can support HIPAA risk assessments and BAA considerations where required.

Proven in a US Healthcare Environment

Icon Map has undergone a full security and compliance review with a US healthcare provider, including HIPAA-related assessment of data handling and architecture.

Following this review, the product was approved through the organization’s internal security and procurement process.

Customer references may be available on request.

NHS Approved Power BI Mapping Visual

Icon Map has also been approved as an NHS-approved third-party application, supporting deployment within UK healthcare environments.

NHS Security and Governance Assessment

As part of the NHS approval process, Icon Map was reviewed against NHS Digital and NHS England requirements, including:

• Application security and architecture
• Data handling and processing model
• Alignment with NHS data protection standards

This confirms suitability for use within NHS organizations, subject to local governance and deployment controls.

UK GDPR and Healthcare Data Protection

Icon Map supports UK GDPR compliance through its architecture:

• No external storage or processing of healthcare data
• All data remains within the customer’s Microsoft tenant
• No transmission of dataset contents to Tekantis infrastructure

This approach supports secure handling of sensitive healthcare and operational data.

Icon Map for Fabric in Healthcare

Icon Map for Fabric is a native Microsoft Fabric workload that follows the same principle as the Power BI visual: your data stays in your tenant. The NHS approval and the US healthcare review described above were of the Power BI visual; Icon Map for Fabric has not yet been through either.

Icon Map for Fabric also respects Microsoft Purview sensitivity labels: data under a label with protection settings cannot be published for viewing outside Fabric, and users without the label's export rights cannot download or export it.

Icon Map AI, which lets your organization's own AI assistant build maps, runs on the user's machine and reads data as the signed-in user. It sends Tekantis only license checks and usage records (which tools were used, with no prompts, results or map content). The data it returns to the assistant is seen by the AI model that assistant uses, under your agreement with that provider, so include that provider in your assessment before using Icon Map AI with patient data.

For how each product handles data, its network endpoints and its admin controls, see the Icon Map Pro security whitepaper for the Power BI visuals and the Icon Map for Fabric security whitepaper for the Fabric workload.

Designed for Healthcare Security and Compliance

Healthcare organizations using Power BI can deploy Icon Map within their existing governance frameworks, including:

• HIPAA risk assessments (US)
• Data Protection Impact Assessments, DPIAs (UK)
• Internal security and procurement reviews

Icon Map supports these processes by providing:

• Transparent data flow and architecture
• No external data processing
• Compatibility with tenant-level and network-level controls

Why Healthcare Organizations Choose Icon Map

• Designed for secure Power BI deployments
• No external processing of sensitive data
• Supports HIPAA-aligned architectures
• Approved for NHS environments
• Proven through real healthcare security reviews

Learn more

Read the Icon Map Pro security whitepaper or the Icon Map for Fabric security whitepaper for certification context, external resources, coding standards, and assurance options. You can also download the whitepaper (PDF) directly.

If you require security documentation, support for compliance reviews, or a discussion on deploying Icon Map in a healthcare environment, please get in touch.