Security & HIPAA
Protected health information, protected.
AminoLiance is built for practices that handle PHI every day. The HIPAA Security Rule's technical safeguards — access control, audit controls, integrity, authentication and transmission security — are designed in, not bolted on.
Strong sign-in
- Unique accounts for every team member — no shared logins.
- Two-factor authentication with an authenticator app and one-time recovery codes; required for new practices and platform administrators.
- Passwords hashed with scrypt; five wrong attempts lock the account for 15 minutes, counted atomically so parallel guessing can't slip past.
- Email ownership verified before a new account can open patient records.
Least-privilege access
- Six roles — owner, admin, physician, nurse, front desk, billing — each limited to what the job needs.
- Only prescribers can change an active treatment plan; only providers can sign a physician attestation.
- Every server action checks permission itself; screens are never the security boundary.
Sessions that end
- Idle sessions sign out on a timer each practice sets, plus a 12-hour absolute limit.
- See and end your active sessions; turning on two-factor signs out everything else.
- Handing a device to a patient ends the staff session, so the back button can't reveal the chart.
A complete audit trail
- Append-only log of sign-ins, changes, exports and every view of a patient's chart.
- PHI access and audit-log reports, exportable for your compliance reviews.
- Signed documents keep an event history: who prepared, sent, signed, witnessed and attested — with time and network address.
Documents you can stand behind
- Signers confirm their date of birth and a one-time code emailed at the moment of signing; links expire, can be revoked and lock after repeated wrong answers.
- Every step — sent, opened, verified, initialed, signed — goes into a hash-chained audit trail with time, IP and device.
- Completed documents are sealed with a SHA-256 hash, stored encrypted, and downloaded as digitally signed PDFs with a certificate of completion.
- Anyone holding a document can confirm it is genuine and unaltered on the public verification page.
- Each published form version is frozen; documents always show exactly what was signed.
Isolation between practices
- Every record belongs to one practice and every query is scoped to it.
- Platform administrators manage practices and libraries but never see patient records.
- Payment processing receives practice billing details only — never patient data.
Protection of data
- Traffic is encrypted in transit with HTTPS; secure, HTTP-only, same-site cookies.
- Two-factor secrets are encrypted at rest with AES-256-GCM.
- Spreadsheet exports neutralize formula injection; downloads are never cached.
Backups and continuity
- Consistent online backups with integrity checks.
- A canceled or lapsed account stays readable, so a practice can always retrieve and export its records.
- Records are retained, never silently deleted.
A Business Associate Agreement with every plan
When your practice signs up, you accept our BAA alongside the Terms of Service. It sets out how we safeguard PHI, report incidents, flow obligations down to subcontractors and return or destroy data when you leave.
Read the BAACompliance is a shared responsibility
Software can enforce safeguards; it can't set your policies. Your practice remains responsible for its risk analysis, workforce training, who it gives access to, device security in the clinic and the content of the forms it uses — reviewed with your counsel. We're glad to help with the technical side of your assessment.