Security you can verify, not just trust.
Independent clinics deserve the same security posture as hospital systems — and the right to inspect it before signing. Here's ours, in the open.
Encryption everywhere
TLS 1.3 in transit. AES-256 at rest for all PHI columns and storage buckets. Payer-portal credentials wrapped with per-clinic KMS envelopes.
Row-Level Security by default
Every table enforces clinic-scoped RLS in the database itself. No application-code bug can leak PHI across clinics.
Immutable audit log
Every PHI read and write emits an audit event via database triggers. Logs are append-only and exportable for compliance reviews.
Least-privilege access
Role-based clinic membership with owner / admin / staff scopes. Service-role writes are gated behind server-side authorization checks.
Attestations & audits
Need a signed BAA?
Every paid plan includes a Business Associate Agreement. Request one before you upload your first patient record.
Questions or a security disclosure? Email security@priorauthiq.com.