Data protection
Built to keep PHI out. By design, not by policy.
Prep Medics is built so protected health information can't get in. Here are the answers your privacy and security teams will ask for.
caught as it's typed, and again on the server
Four checks, not one
Nothing identifiable gets saved.
Patient details are stopped at every way in, so your privacy and security teams doesn't have to rely on people remembering a policy.
- 1
As people type
Every text box checks what's typed and won't save anything that looks like a patient identifier. It says why, and what to do instead.
- 2
On our servers
Every save is checked again on the server, including anything sent through the API. A modified browser can't get round it.
- 3
In uploaded files
Documents and spreadsheets can be read and checked before anyone can download them. Files with patient details are removed.
- 4
In survey answers
Free text in public surveys has identifiers taken out before it's stored, so a respondent can't add them by mistake.
Questions we get asked
Your questions, answered.
The ones your privacy and security teams will ask first.
- Where is our data stored?
- In the United States, encrypted at rest and in transit.
- What stops PHI getting in?
- Social Security numbers, dates near birth words and your own medical record number formats are blocked as people type, and checked again when saved. Uploaded files can be checked too.
- Who can see what?
- Roles for members, leads, managers, quality teams and admins. Private projects stay private. Department leads see their own departments.
- Can we see who looked at what?
- Yes. Every view of a project, report or file is logged, and admins see 90 days of it in the access log.
- What about AI features?
- They're optional and run entirely within AWS, the same cloud that hosts Prep Medics. No data is retained by the AI models or used to train them.
- How do staff sign in?
- With your organization's single sign-on, or email and password with a second factor. People keep their portfolio when they move on.
Access log
An access log your auditors will like.
Filter by person, place and date. Kept for 90 days in the app, and archived beyond that.
- Reads, not just changes. Opening a project, a report, a member list or a file is recorded.
- Screens and integrations too. A board on a ward screen, or an API key, shows up under its own name.
- Blocked details, without the details. You see where a patient identifier was stopped and what kind it was, never the text itself.
who, what and when, in plain words
Sign-in and access
The right people, and only them.
Staff sign in the way they already do at work, and see only what their role allows.
-
Your single sign-on
Connect your organization's sign-in, so access ends when someone leaves.
-
A second factor
Without single sign-on, people sign in with a password and a code.
-
Private projects
Kept to the team, plus the leads and quality staff who oversee that department.
-
Mistakes can be undone
Deleted work can be restored for 30 days, and project history shows who changed what.
Assurance documents
The paperwork, ready to go.
What we can send your team.
- HIPAA position statement (we're built to keep PHI out)
- SOC 2 status
- Security questionnaire answers
- Data processing terms
Review:Placeholders. Fill in only what's actually held before launch. The live site shows "Ask us for our security pack" instead.
Questions we haven't answered?
bring your privacy and security teams along to the demo