Last updated 18 September 2026

Security and HIPAA

What is actually implemented, in the order an evaluator asks about it — and, at the bottom, what we do not claim.

Business associate agreement

Enamel Cloud LLC signs a business associate agreement with every practice before any patient data is loaded. Ask and you will have it the same day; there is no negotiation about whether we sign one.

The assistant cannot see protected health information

Sensitive values are replaced with opaque handles before a request leaves our infrastructure and are resolved back to values in a browser session that is already entitled to see them. The model receives a reference, a carrier name and a procedure code — never a name, a date of birth, a member ID or note text.

This is a property of the channel, not a prompt asking a model to behave. A test in the build pipeline captures the exact bytes sent to the model provider and fails the build if a patient value appears among them, so the guarantee is checked on every commit rather than asserted in a document.

One practice cannot read another

Tenant isolation is enforced in the database with row-level security, under a runtime role that cannot bypass it and is separate from the role that runs migrations. A test in the pipeline tries to cross the boundary on every commit, and a second test asserts the exact table privileges each role holds — which is how we found two tables that had permitted deletes nobody intended.

Encryption

TLS 1.3 in transit, with HSTS and modern ciphers only. Encryption at rest for the database, object storage and backups. Envelope keys for the most sensitive fields are held in a separate secret store rather than in Kubernetes secrets, which are merely base64 inside the cluster database.

Access control

Named accounts, roles scoped to the job, WebAuthn second factors, and sessions that end. Our own staff do not have standing access to practice data; support access is time-boxed, requires a reason, and appears in the practice’s own audit log — where the practice can see it without asking us.

Audit logging

Every read and write of a patient record is recorded with the actor, the record, the time and the reason where one is required. The log is append-only, exportable by the practice, and retained for the period the practice configures.

Backups and recovery

Nightly backups with revision history, encrypted, restorable to a point in time, and tested by restoring them — an untested backup is a belief, not a backup.

Reporting a vulnerability

Send it to [email protected]. We answer, we do not threaten researchers who act in good faith, and we will tell you when it is fixed. Please do not test against a live practice: ask and we will give you an environment.

What we do not claim

We do not claim a certification we do not hold. HIPAA is not a certification — it is a set of obligations, and what we can show you is the control, the code that implements it and the test that keeps it honest. If your procurement process needs a specific attestation, ask us where that work stands and you will get a straight answer rather than a logo.