HIPAA, backups, and your auditor — handled.
Most practice software half-ships the compliance work and leaves the rest on your front desk. We built it into the product.
Your auditor gets a short, complete list.
The core runs on AWS, so one signed Business Associate Agreement (a BAA — the HIPAA contract required of every vendor that handles patient data) covers hosting, email, SMS, storage, and sign-in — plus three narrowly-scoped BAA'd partners for claims clearing, patient mail, and email failover. We hold every BAA so you don't have to chase any.
(Stripe is BAA-exempt under 45 CFR §164.501 for payment processing. It receives no clinical information — no diagnoses, no visit types, no chart data — and charge descriptions come from a fixed server-side allow-list.)
Patient rights, self-service
The portal handles all three HIPAA patient-rights endpoints — most platforms ship one or none. No records-request forms, no 30-day waits, no staff time on manual pulls.
Right of Access
HIPAA §164.524
Download the full record (HTML readable + JSON data) self-service. No 30-day wait, no fee.
Right to Amend
HIPAA §164.526
Submit amendment requests; track status; file a §164.526(d)(2) statement of disagreement after a denial.
Disclosure accounting
HIPAA §164.528
See every third-party disclosure (insurance, court orders, public-health) the practice has made on your behalf. Download the formal accounting.
Privacy notice + audit log visibility
Patient sees what the practice tracks, when staff opened their chart, and how they can exercise rights.
For your auditor
The HIPAA + security posture. AWS-managed where it makes sense, application-managed where the regulation demands it.
Append-only audit log
Every PHI read + write writes a row. Postgres trigger blocks UPDATE/DELETE/TRUNCATE. Defeats application bugs and accidental psql mutations.
CloudTrail with 6-year Object Lock
Multi-region trail with log-file validation. S3 destination has Object Lock COMPLIANCE mode — even root cannot delete logs before retention expires.
Failed-login monitoring
App-level failed sign-ins (Cognito accepted credentials but no matching principal) plus Cognito-level (bad password, locked account) mirrored from CloudTrail to audit_log.
PHI-scrubbing log wrapper
All app code routes through lib/log.ts which redacts known PHI keys + sweeps strings for email/phone/SSN. ESLint enforces it.
Customer-managed KMS
Annual rotation, our key policy. Wired to S3 PatientFiles; RDS rekey scheduled for the next migration window.
Threat detection + alerting
GuardDuty + Inspector watch for compromised credentials, malware, and known CVEs around the clock — and high-severity findings page a human by email, not just sit in a console.
Web application firewall
AWS WAF in front of every page (OWASP rule sets + bad-IP reputation) with rate limiting on the sign-in and AI paths to blunt credential-stuffing and abuse.
Hardened HTTP headers
HSTS, no-sniff, clickjacking and referrer protections on every response — the browser-level basics most healthcare apps skip.
VPC Flow Logs
Network-level forensics retained for breach investigation.
Idle-timeout enforcement
Client-side auto-logout (15 min staff/admin, 30 min patient) per §164.312(a)(2)(iii).
Staff TOTP MFA
Self-service enrollment from /admin/security. Cognito enforces MFA at sign-in once enabled.
Backup & disaster recovery
The question every practice owner should ask — “what happens if something breaks?” — answered. Your data is backed up daily, encrypted, locked against tampering, copied to a second region, and you can see it yourself.
Daily automated backups
Your patient database and uploaded documents are backed up every day into a separate, isolated vault — one that survives even deletion of the live database.
Tamper-resistant vaults
Recovery points are lock-protected, so a bad actor or a panicked mistake can't quietly wipe your backups along with your data — ransomware-resistant by design.
Copied to a second region
Every backup is replicated to a second AWS region, so a regional outage can't take down both your data and its only copy at once.
Restore to a safe point
If data is ever corrupted, we can restore to an earlier point in time — into a fresh database, without touching your live one. A documented restore runbook, not improvisation.
Encrypted end to end
Backups inherit the same encryption as your live data — customer-managed keys at rest, TLS in transit. Nothing readable leaves AWS.
See it for yourself
Your portal shows live backup health — recovery-point counts, lock status, last backup, both regions. We don't just claim your data is safe; you can verify it any time.
Worried about a documentation audit, not just a security one? Read what auditors actually check in chiropractic SOAP notes.
Compliance that's built in, not bolted on.
Everything on this page is in production at ahpts.com today. No screenshots from a roadmap.
14-day free trial · $0 today — card required, no charge until day 15 · cancel in one click · or try the demo first — sample data, no card