Security at ClearMindEHR

Protecting patient data

Business associate agreements

When a practice uses ClearMindEHR, ClearMindEHR acts as the practice's HIPAA business associate under a business associate agreement with the practice.

Separation between practices

ClearMindEHR is a multi-tenant cloud service. Each practice's records are separated in the database with row-level security on most patient-data tables, in addition to the checks every request passes in the application. Each practice signs in at its own address.

Encryption

Connections between your browser and our network edge use TLS 1.2 or later. The production database is encrypted at rest by our hosting provider.

Audit logging

Signed-in access to patient records is recorded in an audit log. Clinical and administrative events are also kept in a tamper-evident, hash-chained log, so a changed entry can be detected.

Signed records are kept

Signed notes are not deleted. A signed visit note can be corrected for a short time after signing, or withdrawn, which marks it void and keeps it; after that, a correction is added as an addendum. Duplicate charts are merged by linking them, so both records survive.

Access to the platform

Roles

Each staff member has a role, such as provider, billing or administrator. The server checks every signed-in request against the user's practice and role, and many features also require a specific permission, such as clinical or billing.

Two-step sign-in

Staff can add a second sign-in step with an authenticator app. Once it is set up, the code is asked at every password sign-in.

Idle sign-out

The staff web app signs out after 15 minutes without activity, with a warning 2 minutes before.

Changes to the platform

Our practice is that every code change goes through a pull request with automated type checks and tests before release, and that production data is never edited by hand: a data correction ships as code.

Vendors and AI

Vendors

We track the agreements of each vendor that handles patient information on our behalf as part of our compliance program.

AI drafts; clinicians decide

A note is not final until a clinician signs it. The AI does not sign notes or send prescriptions.

Our compliance program

HIPAA and SOC 2

We manage our HIPAA and SOC 2 program in Vanta. We have not yet completed a SOC 2 audit.

System status

Current status is at clearmindehr.ai/status.

Reporting a security issue

How to report

Email [email protected] with what you found, where, and how to reproduce it. If your finding involves patient information, describe it rather than copying it into your report.

What to test, and what not to

Test only accounts you own or that we have given you. Do not test a practice's own address or its data. If you come across patient information or anyone else's data, stop, do not view, copy, keep or share it, and tell us at once. No denial-of-service, spam or scanning that degrades the service, no phishing or social engineering of our staff or the practices we serve, and no physical attempts.

Disclosure

Please give us reasonable time to fix an issue before you disclose it. We do not run a paid bug bounty.