Security and Compliance
Updated: 29th October, 2025
Security, privacy, and responsible data governance are important to ClinicianCore.
ClinicianCore is designed to support healthcare organizations with secure communication, appropriate access controls, and safeguards intended to protect sensitive information, including Protected Health Information (PHI).
Security and Compliance by Design
ClinicianCore incorporates administrative, technical, and organizational safeguards designed to protect information and support the security and privacy requirements of healthcare organizations.
Our security approach includes measures designed to:
- Protect sensitive information
- Restrict access to authorized users
- Support appropriate authentication and access management
- Protect information during transmission and storage
- Maintain appropriate accountability and oversight
- Support responsible data management and retention practices
Security measures may vary depending on the ClinicianCore service, functionality, and intended use.
HIPAA and Business Associate Agreements
ClinicianCore is designed to support organizations subject to HIPAA and other applicable healthcare privacy and security requirements.
Where ClinicianCore acts as a Business Associate, a Business Associate Agreement (BAA) may be provided as appropriate.
Use of ClinicianCore does not, by itself, make an organization compliant with HIPAA or any other law or regulation. Each organization remains responsible for its own compliance program, policies, procedures, workforce practices, and use of the platform.
Data Management and Retention
ClinicianCore manages information according to the purpose of the applicable service, organizational requirements, and applicable legal, regulatory, security, and operational considerations.
Retention and deletion practices may differ depending on the type of information and functionality involved.
Organizations remain responsible for determining and applying their own record-retention, documentation, and data-governance requirements.
Protecting Information
ClinicianCore uses safeguards designed to protect information against unauthorized access, use, disclosure, alteration, or loss.
These safeguards may include access controls, authentication measures, encryption, monitoring, audit capabilities, and other appropriate security controls.
ClinicianCore regularly evaluates its security practices as the platform, technology environment, and applicable requirements evolve.
Privacy and Data Minimization
ClinicianCore seeks to collect, use, retain, and process information only as appropriate for the applicable service and its intended purpose.
Organizations and users should use ClinicianCore in accordance with their own privacy, security, documentation, and information-governance policies.
Shared Responsibility
Security and compliance are shared responsibilities.
ClinicianCore provides technology, safeguards, and administrative capabilities designed to support secure healthcare communication. Healthcare organizations remain responsible for how their users, administrators, devices, policies, and workflows interact with the platform.
Does ClinicianCore support HIPAA-regulated organizations?
Yes. ClinicianCore is designed to support healthcare organizations subject to HIPAA and other applicable healthcare privacy and security requirements. The platform provides security, access-control, audit, and data-governance capabilities intended to support an organization’s broader compliance program.
Does using ClinicianCore make an organization HIPAA compliant?
No. No technology platform by itself makes an organization fully HIPAA compliant. Healthcare organizations remain responsible for their own policies, procedures, workforce practices, risk assessments, access controls, and regulatory obligations.
Does ClinicianCore sign Business Associate Agreements (BAAs)?
Where ClinicianCore acts as a Business Associate, a Business Associate Agreement may be provided as appropriate to the applicable relationship, services, and contractual requirements.
How does ClinicianCore protect information?
ClinicianCore uses administrative, technical, and organizational safeguards designed to protect information against unauthorized access, use, disclosure, alteration, or loss. Depending on the service and functionality involved, these safeguards may include authentication, access controls, encryption, monitoring, audit capabilities, and other security measures.
Does ClinicianCore use encryption?
Yes. ClinicianCore uses encryption and other security measures designed to protect information during transmission and while stored. Specific security controls may vary depending on the applicable service, technology environment, and intended use.
Does ClinicianCore use access controls?
Yes. ClinicianCore uses access-management and authorization controls designed to ensure that access is appropriately restricted based on user roles, permissions, and organizational requirements.
Does ClinicianCore support multi-factor authentication?
Yes. ClinicianCore supports multi-factor authentication as an additional security measure designed to help protect accounts against unauthorized access.
Does ClinicianCore maintain audit information?
ClinicianCore incorporates audit and accountability capabilities designed to support security, operational oversight, and applicable compliance requirements. The nature and retention of audit information may vary based on the applicable service, security requirements, and organizational policies.
How does ClinicianCore manage data retention?
ClinicianCore manages information according to the purpose of the applicable service, organizational requirements, and applicable legal, regulatory, security, and operational considerations. Retention and deletion practices may differ depending on the type of information and functionality involved.
Healthcare organizations remain responsible for establishing and applying their own record-retention and information-governance requirements.
Can information be deleted?
Where deletion functionality is available, authorized users or organizations may delete eligible information in accordance with the applicable service, permissions, and data-governance requirements. Certain information may need to be retained where required for security, legal, regulatory, audit, contractual, or operational purposes.
Does ClinicianCore sell personal information or PHI?
No. ClinicianCore does not sell Protected Health Information (PHI). Information is handled in accordance with applicable law, contractual obligations, and the purpose for which the service is provided.
Does ClinicianCore use information for advertising?
ClinicianCore does not use PHI for advertising or targeted marketing. Information collected through the public website may be used for legitimate website operations, analytics, communications, and service improvement in accordance with the ClinicianCore Privacy Policy.
Is security the responsibility of ClinicianCore or the healthcare organization?
Both. ClinicianCore provides technology, safeguards, and administrative capabilities designed to support secure healthcare communication. Healthcare organizations remain responsible for how their users, administrators, devices, policies, and workflows interact with the platform.
ClinicianCore provides the secure infrastructure, controls, and governance capabilities required to support protected healthcare communication.
Healthcare organizations remain responsible for how their users, administrators, devices, policies, and workflows use the platform.
Together, these controls create a security model designed around privacy, accountability, controlled access, and purpose-based data retention.