HIPAA
How we keep your record safe
HIPAA-paranoid by design. Defense in depth. BAAs with every vendor that touches PHI.
Row-level security on every table
Patient A cannot read Patient B's data. Period. Enforced by Postgres row-level security policies on every PHI table.
Audit log on PHI changes
Every write and every export is recorded: who, what, and when.
PHI scrubber on every log
Error monitoring, product analytics, and server logs are all sanitized before any error data leaves our infrastructure.
Break-glass with mandatory justification
By design, access to a patient outside an assigned panel requires a documented reason before the record opens.
Encrypted in transit and at rest. We sign a BAA with every covered partner.