Our Commitment to HIPAA Compliance
RxEMR is designed and built with HIPAA (Health Insurance Portability and Accountability Act) compliance as a core requirement. We implement administrative, physical, and technical safeguards to ensure the confidentiality, integrity, and availability of protected health information (PHI).
Technical Safeguards
Access Control
Unique user IDs, role-based access, automatic logoff, and emergency access procedures. Every access to PHI is authenticated and authorized.
Audit Controls
Comprehensive audit logs record all PHI access, modifications, and deletions. Logs include user ID, timestamp, IP address, and action details.
Integrity Controls
Mechanisms to ensure PHI is not improperly altered or destroyed. Electronic signatures, version history, and tamper-evident audit trails.
Transmission Security
End-to-end encryption using TLS 1.3 for all data in transit. PHI is encrypted before leaving the client and only decrypted at the authorized destination.
Administrative Safeguards
- Security Management Process: Formal risk analysis and risk management programs
- Assigned Security Responsibility: Dedicated security officer and compliance team
- Workforce Security: Background checks, role-based training, and sanctions for policy violations
- Information Access Management: Policies for authorizing and terminating access to PHI
- Security Awareness Training: Regular HIPAA training for all employees
- Contingency Plan: Disaster recovery, data backup, and emergency mode operations
Physical Safeguards
- Facility Access Controls: Restricted access to data centers with multi-factor authentication
- Workstation Security: Policies for workstation use, placement, and security
- Device and Media Controls: Disposal, re-use, and accountability for hardware containing PHI
Business Associate Agreements
RxEMR enters into Business Associate Agreements (BAAs) with all customers as required by HIPAA. Our BAAs outline each party's responsibilities for protecting PHI and are available upon request.
Breach Notification
In the event of a breach of unsecured PHI, RxEMR will notify affected customers without unreasonable delay and within 60 days of discovery, as required by HIPAA. Notifications will include a description of the breach, types of information involved, steps affected individuals should take, and our remediation efforts.
Compliance Documentation
For a copy of our HIPAA compliance documentation or to request a BAA, please contact us at compliance@rxemr.com.