Security
Security, described plainly.
We would rather show your security team the architecture than a wall of badges. Here is how Sammy, a HIPAA compliant hospital EHR, protects patient data.
HIPAA compliant
Sammy is built and operated to HIPAA’s administrative, physical and technical safeguards, and we sign a Business Associate Agreement with every hospital before any patient data arrives.
One hospital, one deployment
Each hospital runs in its own deployment, with its own database, storage and access roles. There is no shared customer table, and nothing is pooled across hospitals.
Our own clinical AI engine
Sammy’s AI is a proprietary engine built for the chart: it drafts, proposes and checks every suggestion against what was actually said. Any infrastructure partner that touches patient data signs a Business Associate Agreement first.
Sammy suggests; people write the chart
Everything Sammy produces is a suggestion. Only a person’s action turns it into chart data, and every suggestion is logged with an undo.
Every read, every write
Changes go to an append-only record, chart access is logged, and break-the-glass access covers the exceptions.
Sign-in your IT already trusts
Microsoft and Google single sign-on, or passwords with authenticator-app MFA and recovery codes. A hospital can require MFA for everyone.
Encrypted and backed up
TLS in transit and managed-key encryption at rest. Restores from backup are rehearsed, not assumed.