Security at RxEMR
Security is foundational to everything we build at RxEMR. We employ a defense-in-depth strategy that protects patient data at every layer — from the physical data center to the application and user interface.
Encryption
Data in Transit
All API and web traffic is encrypted with TLS 1.3. Certificate pinning and HSTS headers prevent downgrade attacks and man-in-the-middle interception.
Data at Rest
All PHI and sensitive data is encrypted at rest using AES-256. Database files, backups, logs, and temporary files are all encrypted with FIPS 140-2 validated modules.
Application Security
- Authentication: bcrypt password hashing, optional multi-factor authentication (MFA), and session management with automatic timeout
- Authorization: Role-based access control (RBAC) with granular permissions per module, action, and data scope
- Input Validation: Server-side validation, parameterized queries to prevent SQL injection, and output encoding to prevent XSS
- CSRF Protection: Anti-forgery tokens on all state-changing requests
- Rate Limiting: API rate limits and brute-force protection on login endpoints
- Session Security: HTTP-only, Secure, SameSite cookies with automatic rotation
Infrastructure Security
- Network Security: Firewalls, intrusion detection/prevention systems, and DDoS protection
- Vulnerability Management: Regular automated and manual penetration testing, dependency scanning, and patch management
- Monitoring: 24/7 security monitoring, anomaly detection, and incident response procedures
- Backup & Disaster Recovery: Automated encrypted backups, geographic redundancy, and tested recovery procedures
Compliance & Certifications
- HIPAA compliance with annual risk assessments
- SOC 2 Type II examination (in progress)
- NDPR (Nigeria Data Protection Regulation) compliance
- GDPR readiness for European customers
Security Contact
To report a security vulnerability or for security-related inquiries, please contact our security team at security@rxemr.com. We practice responsible disclosure and will respond to verified reports promptly.