Security & Privacy
Last Updated: 21 April 2025
At MedPilot, we prioritize the security of your data and the privacy of your patients. Our platform is designed to meet stringent healthcare regulations, including HIPAA, GDPR, and HITRUST. Below, we outline our commitments and practices to safeguard your information.
1. Data Protection
Encryption
- In Transit: All data transmitted between your devices and MedPilot is encrypted using TLS 1.3 (256-bit AES).
- At Rest: Patient records, billing data, and communications are encrypted using AES-256 encryption.
Access Controls
- Role-Based Permissions: Granular user roles (e.g., physician, nurse, billing staff) restrict access to sensitive data.
- Multi-Factor Authentication (MFA): Required for all administrative accounts.
- Audit Logs: Track user activity, logins, and data modifications in real time.
Infrastructure Security
- Cloud Hosting: Data is stored in SOC 2 Type II and ISO 27001-certified AWS data centers.
- Network Security: Firewalls, intrusion detection systems (IDS), and regular penetration testing.
- Vulnerability Management: Automated scans and manual code reviews to address risks proactively.
2. Compliance & Certifications
Regulatory Adherence
- HIPAA: Fully compliant with the Health Insurance Portability and Accountability Act.
- GDPR: Compliant with EU General Data Protection Regulation (for international users).
- HITRUST CSF: Certified for risk management and data protection.
Third-Party Audits
- Annual audits by independent firms validate our security controls.
- SOC 2 Type II reports available under NDA for enterprise customers.
3. Privacy Practices
Data Ownership
- Your Data Belongs to You: Patients’ Protected Health Information (PHI) and practice data are owned solely by your organization.
- No Third-Party Sharing: We never sell or share PHI with advertisers, insurers, or other third parties without explicit consent.
Data Minimization
- Collect only essential data required to deliver the Service (e.g., patient demographics, treatment records).
Breach Notification
- In the unlikely event of a data breach, we will notify affected users within 72 hours and collaborate to mitigate risks.