Practice Harbor implements the full set of administrative, physical, and technical safeguards mandated by the HIPAA Security Rule (45 CFR §§ 164.308–164.312) and the HITECH Act. Technical safeguards: AES-256 encryption at rest under AWS KMS-managed keys; TLS 1.2+ in transit (minimum negotiated protocol TLSv1.2_2021 at the CloudFront edge); immutable per-resource version history; FHIR AuditEvent access logging; and attribute-based access control evaluated server-side on every request. Administrative safeguards: a documented Security Risk Analysis reviewed on an ongoing basis, a maintained Business Associate Agreement register, and workforce security policies. Physical safeguards are inherited from AWS data centers under the AWS Business Associate Addendum. Business Associate Agreements are executed with every subprocessor that receives PHI.

The system of record is a FHIR R4 datastore backed by Amazon Aurora PostgreSQL 16.11 in a Multi-AZ configuration with storage-level AES-256 encryption (KMS) and a 7-day automated backup window with point-in-time recovery. Each FHIR resource type is persisted to a primary table plus an append-only <Resource>_History table, so every create/update/delete produces an immutable, individually addressable version rather than an in-place overwrite. Large binary objects (documents, uploads, generated PDFs) are stored in Amazon S3 with server-side encryption. Ephemeral caching and rate-limit state use Amazon ElastiCache for Redis. No PHI is stored on application compute nodes, which are stateless.

Every request is authorized server-side against a per-membership AccessPolicy. Reads and writes are constrained to the caller’s permitted FHIR compartments (patient, organization, and profile scopes) and further filtered by resource-type criteria and field-level read/write constraints; unauthorized rows are excluded at the query layer, not hidden in the UI. Roles — practitioner, supervisor, biller, scheduler, and portal client — resolve to distinct AccessPolicies following least privilege. Client-portal access is scoped per client and honors guardian and couples visibility rules. Administrative or on-behalf-of access requires an admin ProjectMembership and is itself recorded as an AuditEvent.

Passwords are stored as bcrypt hashes; plaintext credentials are never persisted. Sessions are issued as signed JWTs (RS256/ES256 asymmetric signing) with a 1-hour access-token lifetime and a rotating refresh token (default 2-week lifetime). TOTP-based multi-factor authentication (RFC 6238 authenticator applications) is supported for practice accounts with enrollment offered at sign-in. Request rate limiting is enforced at the API layer.

Access and mutation events are recorded as FHIR AuditEvent resources capturing actor, action, target resource, and timestamp, retained for retrospective analysis. Because every resource type maintains an append-only _History table, the complete version lineage of any record — including prior field values and the authoring identity — is independently reconstructable. Infrastructure-layer events are captured via AWS CloudTrail and CloudWatch.

Yes. The Practice Harbor Business Associate Agreement is incorporated by reference into the Terms of Service (§ 4.4) and is effective upon account creation; its full text is published at practiceharbor.com/baa. The BAA governs permitted uses and disclosures, safeguards, subcontractor flow-down, breach reporting, and — per §§ 4.4–4.7 — AI processing terms including a contractual prohibition on the use of PHI for model training. Countersigned standalone copies are available on request.

AI documentation is optional and configured per practice; session recording requires client consent in the workflow. Audio is transcribed by subprocessors operating under executed BAAs (Deepgram primary, Groq fallback); note drafting is performed by Anthropic under an executed BAA. Use of PHI for AI model training is contractually prohibited (BAA § 4.5). Session audio is processed for transcription and then deleted; recordings are not stored as durable records. Transcript retention is practice-configurable and expired transcripts are purged on an automated daily schedule (7-day minimum). No AI-generated content is committed to the record without clinician review and electronic signature.

At rest: AES-256 across the Aurora PostgreSQL cluster and S3 object storage, with keys managed by AWS KMS. In transit: TLS for all client and inter-service connections, with a minimum negotiated protocol of TLSv1.2_2021 at the CloudFront edge and ACM-provisioned certificates. Workstation-level disk encryption applies to operational endpoints.

All ingress transits Amazon CloudFront with AWS Shield DDoS protection and AWS WAF deployed on the application, front-end, and storage distributions (managed rule sets covering common exploit classes). Origin compute runs on Amazon ECS Fargate within an isolated Virtual Private Cloud; security groups follow least privilege, restricting traffic to required ports and approved sources. Public object access is disabled at the bucket level.

Source repositories have automated dependency vulnerability alerting enabled; findings are triaged and remediated by severity. Changes flow through version control with peer review, automated test suites, and pre-deployment verification; infrastructure is defined as code and subject to the same review path. Recurring internal adversarial security audits are conducted against access-control policies and server-side authorization.