Security, privacy and HIPAA

How your patients' records are held

A signed BAA before any patient data moves

The Business Associate Agreement is executed before the first patient record reaches the system.

Named accounts, and a record of every access

Each member of staff signs in under their own account; there is no shared clinic login. Every time a record is opened or changed, the account, the record and the time are logged, and that log is retained for six years.

Encrypted in transit and at rest

All patient data is encrypted in transit and at rest, and held on private, access-controlled infrastructure. No patient data is publicly accessible.

Your records come out on request

An export of your records is produced whenever you ask for it, not only when you leave. If you do leave, that access continues for 30 days; after it the data is deleted and you receive written confirmation of what was deleted and when.

Send a security question through the questions panel.