---
title: Data Security in the EHR
description: Data Security
---

[Skip to content](https://support.joinportrait.com/knowledge-legacy/data-security-in-the-ehr#main-content)

[Submit a ticket](https://support.joinportrait.com/knowledge-legacy/kb-tickets/new?hsLang=en-us)

![Portrait-Logo](https://support.joinportrait.com/hubfs/Portrait-Logo.svg)

Open main navigation

Close main navigation

- [Submit a ticket](https://support.joinportrait.com/knowledge-legacy/kb-tickets/new)

 How can we help you?

- There are no suggestions because the search field is empty.

1. [Support Center - Legacy](https://support.joinportrait.com/knowledge-legacy?hsLang=en-us)
2. [EHR](https://support.joinportrait.com/knowledge-legacy/ehr?hsLang=en-us)

# Data Security in the EHR

### **Encryption**

- **Data at Rest**: All Protected Health Information (PHI) is encrypted using AES-256 encryption, managed through AWS Key Management Service (KMS), ensuring even physical storage drives are unreadable without authorization.
- **Data in Transit**: TLS 1.2+ encryption secures data moving between users, systems, and third parties (e.g., labs, providers).

---

### **Access Controls & Authentication**

- **Role-Based Access Control (RBAC)**: Permissions are strictly tailored to user roles (e.g., patients, providers, admins), adhering to the principle of least privilege.
- **Multi-Factor Authentication (MFA)**: Required for all administrative access to systems handling PHI.
- **Audit Logs**: All access attempts and modifications are logged via AWS CloudTrail and monitored in real time for anomalies.

---

### **HIPAA Compliance & Certifications**

- **AWS HIPAA-eligible Services**: Our infrastructure leverages AWS services covered under a Business Associate Agreement (BAA), ensuring HIPAA compliance.
- **Regular Audits**: We undergo third-party audits (e.g., SOC 2, HIPAA gap assessments) to validate controls.
- **Business Continuity**: PHI is redundantly stored across AWS Availability Zones with automated backups and disaster recovery protocols.

---

### **Proactive Threat Detection**

- **24/7 Monitoring**: AWS GuardDuty and custom tools detect and mitigate threats like unauthorized access or unusual activity.
- **VPC & Firewalls**: Network traffic is isolated within Amazon Virtual Private Clouds (VPCs) and protected by strict firewall rules.

---

### **Human Safeguards**

- **Mandatory Training**: All staff complete HIPAA and cybersecurity training.
- **Confidentiality Agreements**: Employees and partners are contractually bound to protect PHI.

---

### **Transparency & Your Control**

- **Data Ownership**: You retain full ownership of patient data—we never share or monetize it.
- **Compliance Support**: We will gladly provide documentation (e.g., BAA, audit summaries) to streamline your due diligence.

- [\*Getting Started](https://support.joinportrait.com/knowledge-legacy/getting-started?hsLang=en-us)
- [Announcements](https://support.joinportrait.com/knowledge-legacy/announcements?hsLang=en-us)
- [Apps Status](https://support.joinportrait.com/knowledge-legacy/apps-status?hsLang=en-us)
- [Tips + Quick Links](https://support.joinportrait.com/knowledge-legacy/tips-quick-links?hsLang=en-us)
- [Transitioning to Launch model](https://support.joinportrait.com/knowledge-legacy/transitioning-to-launch-model?hsLang=en-us)
- [EHR](https://support.joinportrait.com/knowledge-legacy/ehr?hsLang=en-us)
- [Medical](https://support.joinportrait.com/knowledge-legacy/medical?hsLang=en-us#main-content)

    - [Consents](https://support.joinportrait.com/knowledge-legacy/medical?hsLang=en-us#consents)
- [Earnings](https://support.joinportrait.com/knowledge-legacy/earnings?hsLang=en-us#main-content)

    - [Legacy](https://support.joinportrait.com/knowledge-legacy/earnings?hsLang=en-us#legacy)
- [Emergency](https://support.joinportrait.com/knowledge-legacy/emergency?hsLang=en-us)
- [Payments](https://support.joinportrait.com/knowledge-legacy/payments?hsLang=en-us)
- [Inventory](https://support.joinportrait.com/knowledge-legacy/inventory?hsLang=en-us#main-content)

    - [Supplier Ship-To's](https://support.joinportrait.com/knowledge-legacy/inventory?hsLang=en-us#supplier-ship-tos)
- [Joint Investments](https://support.joinportrait.com/knowledge-legacy/joint-investments?hsLang=en-us)
- [Patient Comms + Scheduling](https://support.joinportrait.com/knowledge-legacy/patient-comms-scheduling?hsLang=en-us)
- [Marketing](https://support.joinportrait.com/knowledge-legacy/marketing?hsLang=en-us)
- [Compliance](https://support.joinportrait.com/knowledge-legacy/compliance?hsLang=en-us)

[![Portrait black logo](https://support.joinportrait.com/hubfs/Portrait%20black%20logo.svg "Portrait black logo")](https://support.joinportrait.com/?hsLang=en-us)

Copyright © 2025, Portrait