Patient data, protected before the first record arrives.
Encryption, two-factor sign-in, an audit trail and a signed BAA are in place before your workspace holds a single chart. Here is how each one works — and nothing we haven't done.
Encryption
Every page, form and API call travels over HTTPS, and database connections require TLS. Integration keys, connection strings, uploaded chart files and import exports are encrypted with AES-256-GCM before they are written, and our database provider, Neon, encrypts stored data at rest.
Sign-in protection
Passwords are kept only as bcrypt hashes, and session tokens are stored hashed, never in plain form. Staff and portal users — patients and families included — can protect their accounts with an authenticator app, and THNK staff cannot approve a new workspace without two-factor sign-in.
Audit log
Sign-ins, failed sign-in attempts and back-office record changes are logged with the user, the action, the record and the IP address. Each chart also keeps its own access history: who viewed, printed, exported or edited it, and when.
Signed BAA before any PHI
The Business Associate Agreement is accepted in the application, before your workspace exists and before a single file can be uploaded. We record the signer's name and title, the time, the IP address, the agreement version and a fingerprint of the exact text accepted.
Least-privilege access
Roles carry specific permissions — viewing contacts, editing the calendar, seeing financials — and any one user can be granted or denied a permission on top of their role.
The most sensitive records, handled separately
Where a practice turns them on, psychotherapy notes live in their own encrypted table with a separate access log and are never printed, exported or shown in the portal. Substance use records flagged under 42 CFR Part 2 need a consent with every required element before they can be exported.
E-prescribing through a certified partner
Prescriptions are written in DoseSpot inside the chart. DoseSpot holds the Surescripts and EPCS certifications, and each prescriber completes identity proofing and two-factor setup with DoseSpot. We do not claim those certifications ourselves.
No PHI in our email
Emails we send about your account — welcome, billing, support — contain no patient information. Clinical communication stays inside the app.
Your data leaves with you
Ask for a complete export of your records at any time, and any single chart can be downloaded as a FHIR R4 bundle from inside the app. When the agreement ends, we return or destroy your data as the BAA describes.
What stays with your organization
HIPAA compliance is shared. We secure the platform; your organization decides who gets access and how it is used.
- Inviting users, assigning roles, and removing access when staff leave
- Requiring two-factor sign-in for your staff (we recommend it for everyone)
- Your own HIPAA policies, risk assessment and workforce training
- Keeping PHI out of free-text fields that are shared outside the app, such as public website forms
Questions from your compliance officer are welcome.
Start a trial — the BAA is part of signup — or book a call and bring your questionnaire.