Skip to main content

Security & Compliance

Overview​

ACS EHR is designed for organizations with responsibilities under HIPAA, CARF, and Maryland COMAR. The product includes security controls and evidence workflows that can support an organization's program.

ACS EHR does not claim that use of the product alone establishes legal compliance, certification, or accreditation. Each organization remains responsible for its policies, configuration, operations, vendor agreements, and professional review.

Data protection & privacy​

  • Encryption — data encrypted at rest and in transit; runtime secrets protected via a key management service (KMS) with rotation.
  • Minimum necessary / PHI hygiene — logging and telemetry are designed to avoid persisting protected health information.
  • Multi-tenant isolation — organization-scoped access so each program's data is separated by authorization.

Access control​

  • Role-based access control (RBAC) — granular roles and permissions, scoped per organization.
  • Multi-factor authentication (MFA) — optional MFA for ordinary access and TOTP-verified sessions for configured privileged administrator actions.
  • Break-glass emergency access — controlled emergency access sessions that are automatically flagged for post-hoc review.
  • Access recertification — periodic campaigns to re-validate that users retain only the access they need.
  • Vendor & business-associate management — vendor registry, security evidence, and risk-exception tracking for business associates.

Audit & integrity​

  • Full audit trail — append-only audit log with chain-head integrity to detect and deter tampering.
  • State-transition audit — appointments, encounters, and clinical state changes produce an immutable audit record.
  • AI audit — AI-generated drafts and voice-to-note events are captured with a defined retention policy.

Voice & AI boundaries​

  • No raw audio retention in the designated record — Voice-to-Note streams audio to the configured speech-recognition service for transient processing. ACS EHR does not retain the raw audio; only text reviewed and inserted by the user enters the note.
  • AI as draft — AI output is never a medical record until a clinician reviews, corrects, and signs it.

Compliance & quality workflows​

  • Training & certification — staff training packages with quizzes, completion tracking, and certifications to demonstrate competency.
  • Inspections, drills & incidents — track inspections, action plans, emergency drills, and critical incidents for survey readiness.
  • CARF/COMAR-supporting documentation — narrative-first notes and structured assessments that can support accreditation and licensing workflows.

Architecture & operations​

  • AWS-hosted — serverless and containerized deployment with managed, encrypted database and object storage.
  • Infrastructure as code — reproducible, auditable infrastructure via Terraform.
  • Observability — structured logging, metrics, and monitoring.

Public certification, attestation, and independent-testing claims are published only after the applicable evidence and wording receive formal approval.