Patient data deserves more than a checkbox.
XEHR was built for the HIPAA Security Rule from the first line of code. Here is what that means for your practice, in plain words.
Your data stands alone
Your practice’s records are kept private and separate. Nothing is ever shared with or visible to another practice.
Encrypted everywhere
Patient data is encrypted when it is stored and whenever it moves. Documents are never publicly reachable and stream only through the signed-in application.
Every access is recorded
Opening, changing or sharing a patient record is written to a tamper-resistant audit trail your practice administrator can review.
Only the right people
Role-based access for providers, front desk and billers, multi-factor sign-in, and automatic lock-out after repeated failed attempts.
Security is a daily routine, not a document.
Watched around the clock
Automated alerts reach our team the moment something security-relevant changes or looks wrong.
Backed up daily
Your data is backed up every day and can be restored to a point in time.
Filtered at the edge
Traffic is screened before it ever reaches the application.
Checked every hour
Our key controls are re-tested automatically and published on the Trust Center.
Where we stand today
- Business Associate Agreement signed with every customer, on every plan
- Business Associate Agreements in place with every sub-processor that touches patient data
- Built to the HIPAA Security Rule's administrative, physical and technical safeguards
In progress
- Formal HIPAA security risk analysis using the HHS Security Risk Assessment Tool
- ONC Health IT certification
We show these as in progress until they are done. The Trust Center shows the live state.
Found a vulnerability?
Tell us privately and we will work with you to fix it. We will not take legal action against good-faith research that respects patient privacy and stops at proof of the issue.
security@xehr.ioWhat to expect
- We confirm we received your report
- We assess severity and keep you updated
- We credit you after the fix, if you want
HIPAA and security, explained
HIPAA Security Risk Assessment for Small Practices: A Step-by-Step Guide
Oct 12, 2026 · 5 min read
Is MFA Required by HIPAA? Where the Security Rule Update Stands in 2026
Oct 12, 2026 · 4 min read
