Security & HIPAA questions
BAA, encryption, privacy, audit trails and sign-in. Back to all FAQs
Is XEHR built for HIPAA?
Yes. XEHR was built to the HIPAA Security Rule from the start, and we sign a Business Associate Agreement (BAA) with every customer at no extra cost. Patient data is encrypted, access is limited by role, and every access is recorded.
There is no government HIPAA certification for any vendor. Our formal security risk analysis is in progress, and the Trust Center shows our controls checked live every hour.
Do you sign a BAA?
Yes. We sign a Business Associate Agreement with every customer, on every plan, before you go live. Every sub-processor that touches patient data is also under a BAA with us.
Is our practice’s data kept separate from other practices?
Yes. Your practice’s records are kept private and separate, and are never shared with or visible to any other practice.
Is patient data encrypted?
Yes. Patient data is encrypted when it is stored and whenever it moves, using current industry standards.
Is multi-factor sign-in required?
Yes, and it is not optional: every user in every practice signs in with a second factor (an authenticator app). Accounts lock automatically after repeated failed attempts.
What is recorded for HIPAA audits?
Opening, changing or sharing a patient record, sign-ins and settings changes are written to an audit trail your practice administrator can review. Audit records are kept for at least six years, as HIPAA requires.
What happens when a user is deactivated?
They lose access immediately, and the change is recorded in your audit trail. Their past work, such as signed notes and worked claims, stays in place as read-only history.
Compliance / security review?
Email sales@xehr.io for a security review packet, or read the full security page.
