Langford Practice

If your practice keeps patient health information (PHI, or ePHI once it is electronic), these are the HIPAA Security Rule technical safeguards this hosting covers on our side for Langford Practice · Developer, and the parts that stay with the practice.

What your examiner or auditor will ask

What's still on you

• “Minimum necessary”: set user roles so front desk, billing and clinicians each see only what their job needs.
• Your risk analysis and written policies, and training your staff.
• A Business Associate Agreement with us before any PHI goes in (see above).
• Patient access requests and breach notification to patients. Those are the practice's duties.

• Patient records are only reachable from inside the app's private network runs when we set it up
• Patient files and scans are kept in private storage with no internet address runs when we set it up
• No shared password opens the file storage; only this app's own identity can get in runs when we set it up
• The database refuses any connection that is not encrypted runs when we set it up
• The app only answers over encrypted (https) connections runs when we set it up
• Every change to patient records is written to an audit log runs when we set it up
• Patient records can be restored to any point in the last 35 days runs when we set it up
• Settings that would weaken any of this are blocked automatically runs when we set it up
• Your setup is reviewed continuously against the security rules for your kind of data runs when we set it up
• The app is up at its own secure address runs when we set it up
• No patient record opens without signing in first runs when we set it up
• A stranger who guesses a file's address gets “access denied” runs when we set it up