Practice Harbor Trust Center
Overview
Practice Harbor is a behavioral-health practice management platform providing scheduling, clinical documentation, billing and claims, telehealth, and client communication to licensed clinicians and their practices. Protected health information is processed in the platform's capacity as a HIPAA Business Associate to each customer practice.
The system of record is a FHIR R4 datastore on Amazon Aurora PostgreSQL, self-hosted in a dedicated Amazon Web Services account within the United States. All protected health information is encrypted at rest (AES-256) and in transit (TLS 1.2+), with server-side attribute-based access control and immutable per-resource version history.
This Trust Center documents the platform’s security architecture, privacy controls, and HIPAA safeguards, and provides access to security documentation supporting vendor assessments and internal reviews.
Compliance
Frameworks the platform is built to satisfy. The safeguards implementing each are enumerated below.
Documents
Documents marked with a lock are provided by email to identified requesters — use “Request access” above, or email albert@practiceharbor.com.
Knowledge Base (FAQ)
Is Practice Harbor HIPAA compliant?
Practice Harbor implements the full set of administrative, physical, and technical safeguards mandated by the HIPAA Security Rule (45 CFR §§ 164.308–164.312) and the HITECH Act. Technical safeguards: AES-256 encryption at rest (AWS KMS-managed keys for the database cluster, S3-managed keys for object storage); TLS 1.2+ in transit (minimum negotiated protocol TLSv1.2_2021 at the CloudFront edge); immutable per-resource version history; FHIR AuditEvent access logging; and attribute-based access control evaluated server-side on every request. Administrative safeguards: a documented Security Risk Analysis currently undergoing formal adoption (annual and material-change review thereafter), a maintained Business Associate Agreement register, and workforce security policies. Physical safeguards are inherited from AWS data centers under the AWS Business Associate Addendum. Business Associate Agreements are executed with every subprocessor that receives PHI.
What is the data storage architecture?
The system of record is a FHIR R4 datastore backed by Amazon Aurora PostgreSQL 16.11 with storage-level AES-256 encryption under AWS KMS-managed keys and a 7-day automated backup window with point-in-time recovery. Each FHIR resource type is persisted to a primary table plus an append-only <Resource>_History table, so every create/update/delete produces an immutable, individually addressable version rather than an in-place overwrite. Large binary objects (documents, uploads, generated PDFs) are stored in Amazon S3 with server-side encryption. Ephemeral caching and rate-limit state use Amazon ElastiCache for Redis. No PHI is stored on application compute nodes, which are stateless.
How is authorization enforced?
Every request is authorized server-side against a per-membership AccessPolicy. Reads and writes are constrained to the caller’s permitted FHIR compartments (patient, organization, and profile scopes) and further filtered by resource-type criteria and field-level read/write constraints; unauthorized rows are excluded at the query layer, not hidden in the UI. Roles — practitioner, supervisor, biller, scheduler, and portal client — resolve to distinct AccessPolicies following least privilege. Client-portal access is scoped per client and honors guardian and couples visibility rules. Administrative or on-behalf-of access requires an admin ProjectMembership and is itself recorded as an AuditEvent.
How are authentication and sessions secured?
Passwords are stored as bcrypt hashes; plaintext credentials are never persisted. Sessions are issued as signed JWTs (RS256/ES256 asymmetric signing) with a 1-hour access-token lifetime and a rotating refresh token (default 2-week lifetime). TOTP-based multi-factor authentication (RFC 6238 authenticator applications) is available to practice accounts; users enroll from account settings, and once enrolled a verification code is required at every sign-in. MFA is not mandated platform-wide — enforcement is at each practice’s discretion. Request rate limiting is enforced at the API layer.
How is audit logging implemented?
Access and mutation events are recorded as FHIR AuditEvent resources capturing actor, action, target resource, and timestamp, retained for retrospective analysis. Because every resource type maintains an append-only _History table, the complete version lineage of any record — including prior field values and the authoring identity — is independently reconstructable. Infrastructure-layer events are captured via AWS CloudTrail and CloudWatch.
Do you sign a Business Associate Agreement (BAA)?
Yes. The Practice Harbor Business Associate Agreement is incorporated by reference into the Terms of Service (§ 4.4) and is effective upon account creation; its full text is published at practiceharbor.com/baa. The BAA governs permitted uses and disclosures, safeguards, subcontractor flow-down, breach reporting, and — per §§ 4.4–4.7 — AI processing terms including a contractual prohibition on the use of PHI for model training. Countersigned standalone copies are available on request.
Does the company carry liability insurance?
Yes. Somatopia, LLC — the California limited liability company that operates Practice Harbor — carries technology errors & omissions (professional liability) and cyber liability coverage. A certificate of insurance naming the requesting organization as certificate holder is issued through the company’s insurance broker upon request.
How are AI-assisted features processed?
AI documentation is optional and configured per practice; session recording requires client consent in the workflow. Audio is transcribed by subprocessors operating under executed BAAs (Deepgram primary, Groq fallback); note drafting is performed by Anthropic under an executed BAA. Use of PHI for AI model training is contractually prohibited (BAA § 4.5). Session audio is deleted after transcription, and object-storage lifecycle policy permanently expires all session audio — including any prior versions — within 14 days; recordings are not retained as durable records. Transcript retention is practice-configurable with a 7-day minimum, and expired transcripts are deleted automatically on a daily schedule. No AI-generated content becomes part of the signed record without clinician review and electronic signature.
Is data encrypted at rest and in transit?
At rest: AES-256 across the Aurora PostgreSQL cluster under AWS KMS-managed keys, and AES-256 server-side encryption on S3 object storage under S3-managed keys. In transit: TLS for all client and inter-service connections, with a minimum negotiated protocol of TLSv1.2_2021 at the CloudFront edge and ACM-provisioned certificates. Workstation-level disk encryption applies to operational endpoints.
How is the platform protected at the network edge?
All ingress transits Amazon CloudFront with AWS Shield DDoS protection and AWS WAF deployed on the application, front-end, and storage distributions (managed rule sets covering common exploit classes). Origin compute runs on Amazon ECS Fargate within an isolated Virtual Private Cloud; security groups follow least privilege, restricting traffic to required ports and approved sources. Public object access is disabled at the bucket level.
How are vulnerabilities and changes managed?
Source repositories have automated dependency vulnerability alerting enabled; findings are triaged and remediated by severity. All changes are version-controlled, and continuous integration runs automated linting, type-checking, and test suites; a scripted pre-deployment smoke check exercises critical paths against the live system before release. Infrastructure is defined as code, so environment changes are reviewable, revertible diffs rather than untracked console actions. Practice Harbor is developed and operated by a single engineer, who is also the named Security Official: there is no second reviewer, and controls predicated on segregation of duties among multiple staff are not applicable at this scale. The compensating controls are the automated checks above, immutable per-resource version history for every data change, and recurring internal adversarial security audits conducted against access-control policies and server-side authorization.
How is incident notification handled?
Incident notification is governed by HIPAA, the HITECH Act, and the Business Associate Agreement. Affected practices are notified without unreasonable delay and within the timelines required by law and the BAA, with sufficient detail to satisfy each practice’s downstream notification obligations.
Is customer data portable?
Records are maintained in the FHIR R4 open standard rather than a proprietary schema; complete structured exports are available on request, including upon termination of service. Payment processing is performed through each practice’s own Stripe account, which remains the property of the practice; cardholder data is transmitted directly to Stripe and is not stored on Practice Harbor systems.
Data security
5- Encryption at rest — AES-256 across the Amazon Aurora PostgreSQL cluster, under AWS KMS-managed keys, and AES-256 server-side encryption on S3 object storage under S3-managed keys.
- Encryption in transit — TLS for all client and inter-service connections; minimum negotiated protocol TLSv1.2_2021 at the CloudFront edge.
- Audit logging — FHIR AuditEvent records for access and mutation events, complemented by append-only per-resource version history.
- Encrypted backups — Automated encrypted backups with a 7-day window and point-in-time recovery.
- US data residency — All customer data is stored within the United States.
Authentication
4- Password storage — Credentials are stored as bcrypt hashes; plaintext passwords are never persisted.
- Session tokens — Asymmetrically signed JWTs (RS256/ES256): 1-hour access-token lifetime with a rotating 2-week refresh token.
- Multi-factor authentication — TOTP (RFC 6238) authenticator applications, available to practice accounts and enrolled from account settings; once enrolled, a code is required at every sign-in.
- Rate limiting — Request rate limiting is enforced at the API layer.
Access control
5- Server-side authorization — Every request is evaluated against a per-membership AccessPolicy at the query layer, not concealed in the interface.
- Compartment scoping — Reads and writes are constrained to the caller’s permitted FHIR compartments (patient, organization, and profile).
- Least-privilege roles — Practitioner, supervisor, biller, scheduler, and portal-client roles resolve to distinct least-privilege policies.
- Portal scoping — Client-portal access is scoped per client, including guardian and couples visibility rules.
- Field-level constraints — Read/write constraints apply at the field level; unauthorized rows are excluded from result sets.
Data architecture
4- FHIR R4 system of record — Amazon Aurora PostgreSQL 16.11 in an isolated private subnet, with automated encrypted backups and point-in-time recovery.
- Immutable versioning — Append-only <Resource>_History tables; every create, update, and delete is an addressable, immutable version.
- Binary object storage — Documents, uploads, and generated PDFs stored in Amazon S3 with server-side encryption.
- Stateless compute — Application nodes hold no PHI at rest; Amazon ElastiCache for Redis handles cache and rate-limit state.
Network security
4- Network isolation — All infrastructure operates within an isolated Virtual Private Cloud with least-privilege security groups.
- DDoS protection — Amazon CloudFront with AWS Shield protection across all resources.
- Web application firewall — AWS WAF deployed on the application, front-end, and storage distributions.
- Edge protection — Public object access is disabled at the bucket level; TLS terminates at the edge.
Infrastructure
5- Dedicated AWS environment — Self-hosted in a dedicated Amazon Web Services account within the United States.
- Compute — Amazon ECS Fargate origin servers; AWS Lambda for asynchronous processing.
- Telehealth media — Session media is relayed through Practice Harbor-operated infrastructure.
- Infrastructure as code — The environment is defined as code and version-controlled, so changes are reviewable, revertible diffs rather than untracked console actions.
- Operational monitoring — Automated monitoring of scheduled and background processing.
Application security
5- Secret management — Credentials are held in managed secret storage; no secrets reside in source code.
- Change management — All changes are version-controlled, with automated linting, type-checking, and test suites in continuous integration and a scripted pre-deployment smoke check.
- Single-engineer operation — The platform is developed and operated by one engineer, who is also the named Security Official; controls predicated on segregation of duties among multiple staff are not applicable at this scale.
- Dependency scanning — Automated dependency vulnerability alerting on all source repositories.
- Internal security audits — Recurring internal adversarial audits of AccessPolicy enforcement and server-side authorization.
Data and privacy
4- Breach notification — Notification consistent with HIPAA and the HITECH Act.
- Minimum necessary — Applied to email and SMS notifications; appointment reminders contain no PHI.
- Transcript retention — Practice-configurable with a 7-day minimum; expired transcripts are deleted automatically on a daily schedule.
- No tracking — No advertising or analytics trackers on this page or the public tools.
Legal
4- Business Associate Agreement — Incorporated into the Terms of Service (§ 4.4); standalone counter-signed copies available on request.
- Subprocessor agreements — Executed BAAs with every subprocessor that receives PHI.
- AI training prohibition — Use of PHI for AI model training is contractually prohibited (BAA § 4.5).
- Published policies — Privacy Notice, Terms of Service, and a published subprocessor register.
Data portability
4- Open data standard — Records are maintained in FHIR R4; no proprietary record schema is used.
- Structured export — Complete structured exports are available on request, including upon termination.
- Payment independence — Payment processing runs through each practice’s own Stripe account.
- No stored card data — Cardholder data is transmitted directly to Stripe and is not stored on platform systems.
AI
6- Optional and clinician-controlled — AI-assisted documentation is optional and enabled per practice.
- Consent to record — Session recording requires client consent within the practice’s workflow.
- Processing under BAAs — Transcription by Deepgram (primary) and Groq (fallback); note drafting by Anthropic — each under an executed Business Associate Agreement.
- No model training on PHI — Use of PHI for AI model training is contractually prohibited (BAA § 4.5).
- Recordings not retained — Session audio is deleted after transcription and permanently expired by object-storage lifecycle policy — including any prior versions — within 14 days; recordings are not retained as durable records.
- Human sign-off — No AI-generated content becomes part of the signed record without clinician review and electronic signature.
Subprocessors
Third parties that process data on Practice Harbor's behalf. Vendors that process PHI operate under executed Business Associate Agreements.
| Vendor | Purpose | PHI handling | Location |
|---|---|---|---|
| Amazon Web Services | Compute (ECS Fargate, Lambda), Aurora PostgreSQL, S3, KMS, CloudFront/WAF, SES | HIPAA-eligible services under the AWS BAA | United States |
| Deepgram | Speech-to-text transcription, primary (optional AI features) | BAA in place | United States |
| Groq | Speech-to-text transcription, fallback (optional AI features) | BAA in place | United States |
| Anthropic | LLM clinical-note drafting; no-training terms (optional AI features) | BAA in place | United States |
| Stedi | X12 EDI clearinghouse (837P / 270 / 276 / 835) | BAA in place | United States |
| Stripe | Client payment processing; cardholder data is transmitted directly to Stripe and is not stored on Practice Harbor systems | No PHI by design | United States |
No matching content. For specific questions, contact albert@practiceharbor.com.
This page summarizes Practice Harbor's security and privacy practices for informational purposes and does not constitute a contract. The controlling documents are the Business Associate Agreement, Terms of Service, and Privacy Notice. This page is updated as practices evolve.