Clinic OS Pro

Security Overview

How Clinic OS Pro protects your clinic's and your patients' data

Last Updated: October 22, 2026

The short version

PHI is encrypted in transit (TLS 1.2+) and at rest (AES-256), every access is audit-logged, every clinic's data is isolated by tenant, and we sign a HIPAA Business Associate Agreement with every US clinic (countersigned PDF delivered automatically at signup). We hold what patient outreach uses: contact details, date of birth, visits and appointments, and the messages and calls themselves. We import no diagnoses, diagnosis codes or clinical notes from your EMR, and there is no field for them or for Social Security numbers. Free text can still carry health details: notes your staff write, labels and appointment notes brought in from your other systems, and what patients write in messages or say on calls.

Data Encryption

  • In transit: All traffic uses TLS 1.2 or higher. HTTP is redirected to HTTPS; HSTS is enforced.
  • At rest: The production database (PostgreSQL on AWS RDS, us-east-1) encrypts storage with AES-256.
  • Integration credentials: EMR/CRM API keys are encrypted at the application layer before storage -- never stored in plaintext.

Access Controls

  • Tenant isolation: Every database query is scoped to the authenticated clinic. One clinic can never read another clinic's data.
  • Authentication: Unique per-user accounts with bcrypt-hashed passwords, account lockout after repeated failures, and session expiry.
  • Two-factor authentication: TOTP-based 2FA with backup codes, available to every user.
  • Role-based access: Owner and staff roles; billing, financial settings, and data export are owner-only.
  • Platform access: Administrative access is restricted to named platform administrators and logged.

Audit Logging

Every time a user views or changes patient data in the app, an entry goes into the audit log. So does every sign-in (failed and refused attempts included), every time a platform administrator enters or leaves a clinic's account, and every data export. Each entry records who acted, when, and from which IP address and browser. The log is append-only: the database refuses any edit or deletion of an entry. Legal consents (Terms, BAA, messaging consent) are recorded in a separate consent ledger.

HIPAA Posture

  • BAA with every US clinic: Signing is built into onboarding; clinics receive a countersigned, executed PDF automatically. See the Business Associate Agreement.
  • Vendor BAA chain: We maintain BAAs (or documented conduit-exception status) with infrastructure subprocessors that handle PHI. See Subprocessors.
  • Minimum necessary by design: We hold contact details, date of birth, appointments and visit counts, the messages and calls themselves and, where a clinic supplies them, a treatment program label, how the patient pays (for example Medicare or self-pay) and a ZIP code. We do not import diagnoses or diagnosis codes, clinical notes from your EMR, imaging, prescriptions, insurance policy numbers or SSNs.
  • Breach notification: Covered entities are notified of a breach of unsecured PHI within five (5) business days of discovery, per the BAA.

Messaging Compliance

  • Patient opt-outs (STOP) are honored immediately and automatically, including carrier-level STOP blocks.
  • Do-not-contact, email suppression (bounces/complaints), invalid-number flags, quiet hours, and per-patient monthly caps are enforced on every send -- no exceptions.
  • SMS sending requires documented patient consent capture and clinic messaging consent before activation (TCPA).

Infrastructure

  • Hosting: Amazon Web Services throughout – the application on ECS Fargate behind an application load balancer, the database on RDS PostgreSQL, email via SES, async processing via SQS and Lambda, backups on S3. All in us-east-1, all covered by our AWS Business Associate Addendum.
  • SMS carrier: Telnyx, operating under the HIPAA conduit exception (45 CFR 160.103).
  • Monitoring: Dead-letter-queue alarms, daily platform health monitoring, and deduplicated system alerts with email escalation for critical events.
  • Backups: Point-in-time recovery on the production database, plus a nightly per-clinic export to encrypted, versioned S3 storage with a tested restore path.

Your Data, Your Control

  • Clinic owners can export their patient, appointment, and message data as CSV at any time from Settings.
  • On termination, PHI is returned or destroyed per the BAA; destruction is certified in writing on request.
  • Data subject requests are supported via our Privacy Policy process.

Questions or Security Reports

Security questionnaires, vulnerability reports, or compliance questions: support@clinicospro.com (Attn: Security/Privacy Officer). We respond to security reports within two business days.