HIPAA & Privacy Policy

Phase 1 placeholder. The full policy will be finalized before any PHI is processed in production.

Data we store

• User account: username, email, bcrypt password hash, TOTP secret.
• EMR / Billing credentials (PCC, MaxRVU): encrypted at rest with AES-128 (Fernet).
• SOAP notes: stored locally in SQLite. Exports under your control.
• Audit log: every sign-in, settings change, and encounter save is recorded.

Operational guarantees

• MFA (TOTP) required for sign-in.
• Idle session timeout 30 minutes.
• CSRF protection on every state-changing request.
• Passwords never logged or transmitted in plaintext.

Last updated: Phase 1 release.