Designed with HIPAA principles
Smart Clinic implements the administrative, technical, and physical safeguards outlined in the HIPAA Security Rule to protect electronic Protected Health Information (ePHI).
Administrative Safeguards
Role-Based Access Control
Granular user roles (Owner, Admin, Doctor, Assistant, Receptionist) with least-privilege access. Each role has specific, auditable permissions.
Audit Logging
Comprehensive recording of all access, modifications, and exports of patient data — including IP address, user agent, and timestamp.
Incident Response
Emergency access protocol with mandatory justification, supervisor approval, and complete audit trail for every break-glass override.
Technical Safeguards
Encryption at Rest
AES-256-GCM field-level encryption for sensitive PII (notes, addresses, insurance data). Managed database volumes are encrypted at rest.
Encryption in Transit
All data transmitted over TLS 1.3. HTTPS enforced on all endpoints. No plaintext data ever leaves the server.
Authentication Controls
Multi-factor authentication (TOTP), progressive account lockout, password complexity requirements (12+ chars, mixed case, symbols), and secure token rotation.
Physical Safeguards
Infrastructure Security
Hosted on enterprise-grade cloud infrastructure with SOC 2 certified data centers, automated backups, and network isolation.
Data Disposal
Secure data deletion procedures when accounts are terminated. Patient data can be exported before permanent erasure.
Security Checklist
Every item below is implemented and active in the Smart Clinic platform.
Important Note
HIPAA compliance is a shared responsibility between the software platform and the healthcare provider. While Smart Clinic provides the technical and administrative safeguards described above, each clinic is responsible for implementing proper policies, training staff, and configuring the platform according to their specific compliance requirements. This page describes our security architecture and does not constitute legal or compliance advice.