Security & Compliance
Built like the audit is tomorrow.
Home health runs on trust: patients trust the nurse, agencies trust the record, surveyors trust the evidence. Here is, in plain language, how CareSign protects all three.
HIPAA-ready by design
CareSign runs on HIPAA-eligible cloud services under Business Associate Agreements, in United States cloud regions: Google Cloud for application data, files and AI drafting, and AWS for email and maps. Agencies that bill electronically send claims through Stedi, our clearinghouse, also under a Business Associate Agreement. Beyond that, protected health information leaves these services only when your agency sends it to a recipient it chooses, such as a referrer.
Minimal detail in email
Signing requests, confirmations and digests name the form or task and link to the record behind sign-in or a single-use link, instead of carrying clinical notes. When your agency chooses to email a report, such as a referrer progress report or an insurer packet, the PDF goes as an attachment through Amazon SES, which is covered by our Business Associate Agreement with AWS.
Encryption in transit and at rest
All traffic is TLS-encrypted. Data is encrypted at rest by our cloud providers. Signing links use 256-bit single-use tokens that are stored only as SHA-256 hashes. We couldn't leak the raw token if we tried.
Per-agency tenancy isolation
Every record is scoped to an agency, and server-side security rules enforce that boundary on every read and write, including file storage. We audit our rules for provability, not just intent.
Role-based access control
Admins, office staff, QA reviewers, and field nurses each see exactly what their role needs. Access is enforced with authentication claims on the server, not hidden buttons in the UI.
Immutable audit trail
Every create, update, and delete is recorded server-side in an append-only log: actor, action, timestamp, and the fields that changed. No CareSign user, including agency administrators, can edit or delete it.
Versioning and sealed records
Stored documents and signed PDFs live in storage with object versioning, a seven-day recovery window for deleted files, and a nightly backup copy in a second US region. Each signed record is sealed with a content hash, so any change to a signed document shows up when it is verified.
Least-privilege operations
Production access is limited and logged. Scheduled jobs and integrations run under a service account limited to the roles they need.
Invented demo data
Product demos and evaluations run on a demo agency: invented patients, invented visits. Real PHI is never used to sell software.
Signature evidence
How a signature becomes evidence
- 1
Capture
A signature is collected at the bedside, by QR, by link, or through a physician queue. Captured alongside it: signer role, capacity attestation, GPS, and device context.
- 2
Seal
The completed record is fingerprinted with SHA-256 and registered in a tamper-evidence registry, and a verification code and certificate are issued.
- 3
Verify
Anyone with the code (a surveyor, an attorney, the patient's family) can confirm the record's authenticity at a public verify page, without an account and without exposing PHI.
A note on HIPAA, honestly
There is no such thing as a "HIPAA-certified" software product. Anyone who tells you otherwise is selling something. HIPAA compliance is a shared responsibility: CareSign provides the safeguards described on this page and enters into Business Associate Agreements with customer agencies, and your agency's policies, training, and access practices complete the picture. We're happy to walk your compliance officer through the details.
Found a security issue? Please report it to admin@caresignhealth.com. We take reports seriously and respond quickly.
Bring your compliance officer
The best way to evaluate CareSign's security is a demo with the person who signs off on it. Bring their questions and we'll go through them together.