Security
What the softwareactually does.
No seals, no badges, no certification logos. Below is the list of controls DocOS implements, described in enough detail that you can check them.
- 01
Per-practice isolation
Each practice gets its own application and its own database. Nothing is shared between practices, so one practice seeing another's patients is a deployment we do not create.
- 02
An audit log that protects itself
Once written, an audit entry cannot be deleted unless a practice's administrators explicitly turn that protection off. Any purge is itself recorded, and that record is never purged.
- 03
Reads are logged, not just changes
You can answer who opened a patient's information, and when. Most practices cannot answer that question at all.
- 04
Two-factor authentication is available
Any account can enroll in two-factor authentication. Access is granted per person, so every action lands against a named user.
- 05
Encrypted storage
Data is stored on encrypted disks at our hosting provider, and reaches your users over HTTPS.
- 06
Nightly backups that report their own failure
Backups run nightly, and the system tells you when a backup has stopped running. A silent backup is the one that fails you.
On compliance, plainly
Complianceisapropertyofyourpractice'swholeprogram—yourpolicies,yourtraining,yourvendorsandhowyourpeopleactuallybehave.Itisnotapropertyofanysinglepieceofsoftware.
No certification exists that would make software a compliance program. We will not tell you DocOS makes you compliant.
What we will tell you is exactly what the software does, so your program can account for it. A business associate agreement is part of onboarding. DocOS does not provide legal or regulatory advice.
One limit worth stating.
DocOS decides nothing clinical.
The bundled procedure and diagnosis code sets are drafts that your practice verifies. Every clinical outcome names a provider as the decider.