Overview
This page outlines and overview of our overall security stance/posture.
Welcome to the security overview for our healthcare application. Ensuring the privacy and security of sensitive health data is our top priority. In this document, we provide an overview of our security stance, outlining the measures we take to comply with industry standards like HIPAA, protect patient information, and maintain a secure environment for clinicians and administrators.
From authentication mechanisms and data management practices to quality assurance and future-proofing for new features, our approach is designed to uphold the highest standards of security while maintaining ease of use for all users. This document highlights the key areas of focus that guide our ongoing efforts to keep our system secure, efficient, and compliant with healthcare regulations.
By maintaining robust encryption practices, role-based access control, and comprehensive QA workflows, we aim to offer a secure, seamless experience for clinicians, administrators, and patients alike.
Data Storage
Yes
Operational
Authentication
No
N/A
AI
Yes
Operational
Hosting
Yes
Operational
Documentation
No
N/A
1. HIPAA Compliance and Patient Privacy:
Clinician-to-Clinician Messaging: Ensures that private, patient-specific discussions between clinicians are secure and HIPAA-compliant. The system currently emphasizes maintaining strict separation between clinician conversations and patient data to avoid any inadvertent data exposure.
Patient Messaging & Communication: The system takes care to ensure that patients cannot see other patients' data, thereby maintaining privacy in compliance with HIPAA regulations. Clinicians' use of personal devices for communication is being phased out to avoid data leakage, with features like multi-channel communications (e.g., using Twilio or similar services) being considered.
2. Authentication and User Access:
Magic Link Authentication: There's a current push to simplify user login with "magic links" (email-based authentication) to avoid password fatigue and minimize the attack surface of traditional login systems.
Two-Factor Authentication (2FA): While magic links provide some level of security, the implementation of stronger 2FA methods is under consideration for added protection, ensuring that access is secure, especially for sensitive health data.
3. Data Integrity and QA Workflow:
Form Validation and QA Review: The product's data submission process ensures that all patient forms and medical notes go through a quality assurance (QA) review before submission to the system (Kinzer). This ensures that the data is accurate, complete, and complies with billing and medical standards, reducing the risk of incorrect information entering the system.
Error Handling and Adjustments: There’s a clear focus on ensuring that errors during data submission (e.g., in patient records or forms) can be caught, corrected, and resubmitted appropriately through an RPA (robotic process automation) solution.
4. Database Management and Access Control:
Separation of Data Tables: A deliberate decision has been made to separate patient data into individual tables based on forms (e.g., start-of-care forms) to simplify database management and allow for better control of access and retrieval. This enhances security by limiting the amount of data fetched at any one time.
Role-Based Access Control (RBAC): There is an implicit understanding of assigning different access rights to different users (clinicians, administrators, QA teams) based on their roles, ensuring that data is only available to those who need it.
5. Security in Future Plans:
Encryption and Secure Data Transmission: Encryption of data at rest and in transit will be critical to ensuring patient data remains secure, especially as more features such as patient messaging and clinician scheduling come online.
Security Reviews and Updates: There’s an awareness of the need to continuously review security, especially with new features being added, such as clinician scheduling and patient-facing apps, ensuring that potential vulnerabilities are identified and patched quickly.
Last updated