Security and HIPAA
Built for the data you are trusted with
HIPAA applies to everything a therapy clinic stores. NeatPractice builds its safeguards into the product so they work the same for every clinic, every day.
Safeguards in the product
Access
Multi-factor authentication, always
Every user in every clinic signs in with a second factor. Clinics cannot turn it off.
Automatic sign-out
Idle sessions end after 15 minutes by default, adjustable from 5 to 60, with a warning a minute before.
Least access by default
Roles, caseloads and location access decide who sees which patients, enforced on the server for every request.
Break-glass with a reason
Opening a chart outside your caseload requires a stated reason, expires after four hours and notifies clinic admins.
Records
Every chart view logged
Each view, print, export, fax and download of patient data is recorded, so you can see who opened a chart and when.
Append-only audit trail
Changes are written to audit tables the application itself cannot update or delete.
Signed records stay signed
Clinical notes lock on signature and change only through dated addenda. Financial records are reversed, never edited.
Your data
Support only when you allow it
Our staff can enter your clinic only through a time-boxed grant your admin creates, and every action is audited.
Isolated clinic data
Each clinic has its own file storage container, and larger clinics can run on a dedicated database.
No patient data in telemetry
Error tracking and product analytics are scrubbed of patient information, and automated tests with a canary patient prove it on every change.
How we operate
The policies behind the product: where data lives, who handles it, who sees it and what happens when you leave.
Where your data lives
Your clinic, your storage
Patient records stay in your clinic database and your clinic file storage container with our cloud provider.
Dedicated or pooled
Larger clinics can run on a dedicated database. In a pooled one, every row is tagged and filtered by clinic.
Encrypted in transit and at rest
Data travels over encrypted connections, and databases and file storage are encrypted at rest.
An extra layer for identifiers
Highly sensitive identifiers such as Social Security numbers also get field-level encryption.
Service providers and agreements
A BAA before any patient data
Every provider that could handle patient data, from hosting and email to claims and fax, must sign a Business Associate Agreement first.
Assistant with zero retention
The assistant model provider works under zero data retention, and conversations stay in your clinic database, out of our logs.
Telemetry with PHI scrubbed
Error monitoring and product analytics never receive patient information, and canary tests check every change.
Our agreement with you
We sign a Business Associate Agreement with each clinic before it stores patient data with us.
Who can see what
Role templates
Start from Clinic Admin, Front Desk, Therapist, Biller or Read-only Auditor, then clone and adjust.
Caseloads and locations
Therapists see their caseload, supervisors the caseloads they oversee, and location access narrows lists further.
No patient accounts
Reminders and documents open from expiring links, with an identity check before anything sensitive.
Records, retention and leaving
Corrected, never erased
While your clinic is active, records are fixed with addenda, reversals and corrected claims, never hard-deleted.
A full export when you leave
You get records as PDF and data as CSV, and nothing is removed until a 90-day grace period ends.
Two-person purge
A permanent purge needs two administrators to confirm, and a certificate of destruction is kept.
Security questions or a questionnaire to complete? Write to hello@clinic.example.
Questions from your compliance team?
Book a walkthrough and bring them. We will show you each safeguard in the product.