Security
Signing in
- Passwords are at least 15 characters and are stored only as a scrypt hash. There is no forced rotation and no character-class rule, as NIST SP 800-63B recommends.
- 10 wrong passwords lock an account for 15 minutes. Sign-in is also limited by network address and by email address.
- Any staff account can add a second step: a six-digit code from an authenticator app, with 10 single-use recovery codes. A practice can require it for everyone.
- Single sign-on uses OpenID Connect.
- A session lasts at most 8 hours. Each person can see where they are signed in and end every session at once.
Who can see what
- Each person is given specific permissions, and each permission covers their own clients, their team or the whole practice. Access is checked before a page loads, as it renders and again on every action.
- An access review shows who can reach what, and flags invitations still unanswered after 30 days.
- Each practice's records are kept apart by row-level security in the database.
- Computing America staff can open a practice only while Computing America's identity provider lists them as staff, and every practice they open is recorded in its audit trail. Nobody can sign in as someone else.
Client information
- A screen that takes client information stays closed until every service it depends on has signed a business associate agreement.
- Clinical and billing text is encrypted field by field with AES-256-GCM, and each encrypted value is bound to its practice, field and record. Each practice has its own keys. The database keeps them only encrypted, under a key held in AWS Key Management Service that the database never holds.
- Every connection is encrypted with TLS, from the browser to Practice Pillar and from Practice Pillar to its database.
- No page loads analytics, advertising or a tag manager, the client portal and intake forms included. A staff manual article can play a video from YouTube or Vimeo, in its privacy-enhanced mode.
The audit trail
- Every change, every refused attempt and every time someone opens an inquiry goes into an audit log, by record ID and never by description, so no clinical detail reaches it. The application can add to the log and cannot edit or delete it.
- Each entry carries a SHA-256 hash of the entry before it, so an edited or removed entry breaks the chain. Any page of the log, or the whole chain, can be verified at any time.
Services Practice Pillar runs on
Each service, what it handles and whether its vendor has signed a business associate agreement.
- Business associate agreement: Signed
Neon
Every record Pillar keeps, and the audit log
- Business associate agreement: None on file
Vercel
Running the app; every page and form passes through it
- Business associate agreement: Not signed
Computing America's media service, on Cloudflare R2
Screen and camera recordings, their transcripts and share links
- Business associate agreement: None on file
Computing America (CRM service), on Vercel and Neon
An inquiry's contact: name, phone, email, consent, notes and the record of who opened it
- Business associate agreement: Not signed
Computing America (marketing service)
The practice's social posts, ads and tracked links, and their campaign counts
- Business associate agreement: Not signed
Twilio, on the practice's own account
Texts to people who contacted the practice, session reminders to a client or, for a minor, to the representatives who agreed to texts, payment links, and the running-late message to a client in the waiting room
- Business associate agreement: Not signed
Resend
Invitations, password resets and notices to staff
- Business associate agreement: Not signed
Apple, Google, Mozilla and Microsoft push services
A short notice on a staff member's phone or computer that a task, mention, reminder or message is waiting
- Business associate agreement: None on file
Slack, on the practice's own workspace
Plan names, a suggested title and a confirmation sentence, sent to the person who chose Add to Planner; the title they typed and the message's link, received
- Business associate agreement: None on file
Amazon SES
Session reminders, statements, payment links, portal notices and assessment requests
- Business associate agreement: Not signed
Resend
A reply to an email the practice sent, an inquiry forwarded to the practice's intake address, kept on a record, and an email to a planner space's task address, made into a task
- Business associate agreement: Not signed
Anthropic, then OpenAI
Answering a question the manual does not cover, and drafting a clinician's profile introduction
- Business associate agreement: None on file
S3-compatible file storage
Task attachments, documents sent for signature, files a client uploads to an inquiry and documents filed to a client's chart
- Business associate agreement: None on file
AWS Key Management Service
The keys that seal what a client's chart says about their care
- Business associate agreement: None on file
A claims clearinghouse, not chosen yet
Sending claims and eligibility checks to payers, and receiving their acknowledgments and payments
- Business associate agreement: None on file
Google Workspace, on the practice's own account
The forms and documents the resource library links to
- Business associate agreement: None on file
Google Calendar, on the person's own account
A task's title and due day, written to the calendar a person chose to connect, and read back when they move it there
- Business associate agreement: None on file
Microsoft 365 Outlook calendar, on the person's own account
A task's title and due day, written to the calendar a person chose to connect, and read back when they move it there
- Business associate agreement: None on file
Amazon Chime SDK
Telehealth sessions between a clinician and a client
- Business associate agreement: None on file
An e-prescribing partner, not chosen yet
A prescriber writing a prescription in the partner's own screen, and the client's medication list read back from it
- Business associate agreement: None on file
A card processor, not chosen yet
A client paying a balance by card on the processor's own page
- Business associate agreement: None on file
Amazon Bedrock, in AWS us-east-1
Drafting a progress note from a session's transcript, a dictation or a typed summary, and summarizing a chart for the clinician who opens it
- Business associate agreement: None on file
Amazon Bedrock, in AWS us-east-1
Answering a question about the practice scorecard from its own figures
- Business associate agreement: None on file
The practice's own meeting-notes service
Drafting meeting notes from a transcript
- Business associate agreement: None on file
Amazon Bedrock, in AWS us-east-1
Running a planner agent on a task, and writing a task's summary or a plan's progress line, from the task's own fields
- Business associate agreement: None on file
Amazon Bedrock, in AWS us-east-1
Reading the figures off the scan of a paper explanation of benefits, which names the client and the claim
Not in place yet
- No outside penetration test or vulnerability scan has been run yet.
- Not every service on this page has signed a business associate agreement. Until one has, the screens that would send client information through it stay closed.
Report a vulnerability
Email practicepillar@computingamerica.com with what you found and the steps to reproduce it. Do not open, change or keep data that is not yours.
security.txt lists the same address.
Priced by the size of your practice
A question first? Request a demo, or write to practicepillar@computingamerica.com