Skip to content

How we protect patient data

Intake holds the most sensitive data a practice collects.

Request the security packet

Encryption

PHI is encrypted everywhere it sits and everywhere it moves.

  • TLS 1.2 or better for every connection, including patient links.
  • AES-256 at rest for databases, file storage and backups.
  • Managed keys with scheduled rotation; no application-held key material.

Access control

Staff see the minimum necessary to do the job in front of them.

  • Role-based permissions scoped to a practice and, where relevant, a location.
  • Multi-factor authentication required for every Subra Health employee account.
  • Idle session expiry and immediate revocation when a role changes.

HIPAA program

The administrative half of the rule, not only the technical half.

  • A business associate agreement signed before go-live with every practice.
  • Workforce privacy and security training at hire and annually after.
  • Minimum-necessary review of every internal data path.
  • Documented incident response with defined breach-notification timelines.

Infrastructure

Hosted on managed cloud infrastructure in the United States.

  • Patient data stored and processed in US regions.
  • Separate production and non-production environments; no PHI outside production.
  • Encrypted daily backups with periodic restore testing.

Monitoring and audit

Every access to a patient record is attributable after the fact.

  • Append-only audit log of records viewed, changed, exported or deleted.
  • Alerting on unusual access patterns and failed authentication.
  • Log retention aligned to HIPAA record-keeping requirements.

Secure development

Changes reach production through a reviewed, tested pipeline.

  • Peer review and automated checks on every change.
  • Continuous dependency and static analysis scanning.
  • Independent penetration testing with remediation tracked to closure.

Patient rights

Practices stay in control of their patients data, and so do patients.

  • Access and amendment requests supported through your practice.
  • Corrections propagate to the record you hold, with history preserved.
  • Defined retention and deletion on termination of the agreement.

Subprocessors

A short list, each one under agreement.

  • Current subprocessor list available on request for your vendor review.
  • A signed BAA in place with every subprocessor that can touch PHI.
  • Advance notice to practices before a subprocessor is added.

Reporting a vulnerability

If you believe you have found a security issue, tell us before you tell anyone else. We will confirm receipt, keep you updated while we investigate, and will not pursue researchers who report in good faith.

Doing a vendor security review?

Ask for the security packet — no sales call attached.

Built for HIPAA workflows

Bring your compliance officer

Better the hard questions now than a questionnaire later.

Request a demo