What encryption does CareNoteIQ use?

CareNoteIQ uses AES-256 encryption for data at rest (Supabase PostgreSQL), TLS 1.2+ for all data in transit (auto-provisioned by Render), bcrypt with a cost factor of 12 for password hashing, and HTTP-only Secure cookies for session tokens. Encryption is enforced at the infrastructure layer and cannot be disabled.

Can CareNoteIQ sign a BAA?

Yes. CareNoteIQ signs a Business Associate Agreement with every covered entity. You can initiate the BAA flow directly at carenoteiq.polsia.app/baa. The BAA is executed before PHI is enabled on your account.

Security & HIPAA Compliance

We Are a Business Associate

CareNoteIQ operates as a Business Associate under HIPAA. We sign BAAs with every covered entity we serve, binding ourselves to the full HIPAA Security Rule as both a contractual obligation and direct regulatory liability.

Signed BAA flow is live. Request a BAA →

Security Rule Alignment

Safeguard Category	What CareNoteIQ Implements
Administrative	Privacy/Security Officer designation, workforce training, incident response plan, annual risk analysis, vendor management with BAA flow-down to all subprocessors
Physical	Colocation in US-based Render facilities with biometric access, power redundancy, fire suppression, and environmental controls per facility specifications
Technical	Unique user IDs, RBAC, audit logging, encryption at rest and in transit, MFA enforcement, automatic session timeout, PHI access logging

Privacy Rule Disclosures

We use and disclose PHI only for treatment, payment, and healthcare operations as defined under 45 CFR §164.501. No PHI is sold, rented, or used for marketing. All workforce members with PHI access have signed confidentiality agreements and completed HIPAA training.

Breach Notification

In the event of a breach of unsecured PHI, CareNoteIQ will notify the covered entity within 60 days of identification, consistent with the HIPAA Breach Notification Rule (45 CFR §§164.400–414). Notification includes: discovery date, scope of breach, types of PHI involved, and remediation steps taken.

Every PHI Access Is Logged and Timestamped

CareNoteIQ maintains immutable audit logs for all access to and modification of Protected Health Information.

Retention

6 yr

Per HIPAA §164.308(a)(1)(ii)(D)

Fields captured

6+

User, action, resource, timestamp, IP, session

Write mode

Append

No modification by any role, including Superadmin

Each log entry captures:

User — who accessed the record
Action — what they did (view, create, edit, delete, export, sign)
Resource — which patient record and what type of document
Timestamp — date/time in the user's local timezone
IP Address — device origin for forensic traceability
Session ID — to identify concurrent sessions

Sample log entry — patient identifiers redacted

May 12, 2026 · 14:32 UTC · Dr. [REDACTED] · Edit · Clinical Note — RN Visit #4

IP: 192.168.x.x · Session: a3f9… · 4 prior access events this session

[ Audit log viewer screenshot — columns: User, Action, Patient, Document Type, Timestamp, IP ]

Patient identifiers redacted for display. Available on request under NDA.

Encryption at Rest and in Transit

All data is encrypted using industry-standard algorithms. Encryption is enforced at the infrastructure layer — it cannot be disabled by any user role.

Layer	Standard	Implementation
Data at rest	AES-256	PostgreSQL encryption via Supabase (US region); database-level encryption enabled
Data in transit	TLS 1.2+	Auto-provisioned by Render; TLS 1.3 preferred; no fallback to earlier versions
Credentials	bcrypt + salt	User passwords hashed with bcrypt (cost factor 12); salt stored per-user; no plaintext storage ever
Session tokens	HTTP-only, Secure cookie	Session tokens stored in HTTP-only Secure cookies; no token stored in localStorage or URL; 8-hour expiration with sliding refresh

Role-Based Access Control — Least Privilege by Default

Role assignment is tied to job function. No role grants broader access than necessary for clinical care delivery. All role checks are enforced server-side on every API call.

Role	Admission Notes	Clinical Notes	HCTI / Recert	Plan of Care	Med Profile	IDG / Care Plan	Analytics	Admin Settings	User Mgmt
Developer	—	—	—	—	—	—	—	View	—
Superadmin	Full	Full	Full	Full	Full	Full	Full	Full	Full
Physician	—	View	Create/Sign	—	View	—	—	—	—
NP	Full	Full	Draft	View	Edit	View	—	—	—
RN	Full	Full	—	—	Edit	—	—	—	—
MSW	—	Own only	—	—	—	—	—	—	—
Chaplain	—	Own only	—	—	—	—	—	—	—
Aide	—	Visit notes	—	—	—	—	—	—	—

What this means in practice

Aides see only their own visit notes, not other disciplines' clinical documentation
Physicians can view admissions but cannot edit RN documentation
NPs can draft HCTI narratives but cannot sign them — signing is the Physician's role
Superadmin access is restricted to the customer's own admin; CareNoteIQ staff do not access customer PHI
The API is the source of truth — UI elements are hidden based on role, but no data is served based on client-side rendering alone

Infrastructure — US Hosting, No PHI in Logs

CareNoteIQ is built on a US-based infrastructure stack with clear data handling boundaries.

Component	Provider	Region	HIPAA Status
Application hosting	Render	US (Virginia)	✓ BAA signed
Primary database	Supabase (PostgreSQL)	US East	✓ BAA signed
Email delivery	Postmark	US	✓ BAA signed
AI model providers	OpenAI / Anthropic	US	No PHI transmitted
DNS / CDN	Render edge	US	No PHI

PHI in logs — filtered

CareNoteIQ explicitly filters PHI from application and infrastructure logs. Patient names, MRNs, clinical content, and any field mapping to a patient record are excluded from log output at the application layer. Log entries capture metadata (action type, record type, user) but never patient content.

RTO

4 hr

Recovery Time Objective — max acceptable downtime after incident

RPO

24 hr

Recovery Point Objective — max acceptable data loss from failure

Backup cadence

Daily

30-day retention, AES-256 encrypted

Data Handling — Your Data, Your Control

Clear answers to the questions procurement always asks.

Topic	Policy
Data residency	All data stored and processed exclusively in US-based infrastructure. No cross-border transfer.
Data export	Any authorized clinician can export patient data via CSV export in the Analytics Dashboard — already shipped. Formal export requests fulfilled within 5 business days.
Data deletion	Upon contract termination, all ePHI deleted within 30 days. Deletion confirmation certificate provided on request.
Minimum necessary	Every data access request is scoped to the minimum dataset required for the operation, enforced at the API layer.

AI Model Training — Our Policy

CareNoteIQ does not use PHI, clinical notes, or any patient-derived data to train, fine-tune, or improve AI models. No PHI is transmitted to AI providers. All AI processing uses de-identified or synthetic data. BAAs with AI subprocessors are not required because PHI never leaves the HIPAA-covered environment before AI processing.

Surveyor and Audit Ready

CareNoteIQ is designed to support hospice agencies during CMS surveys, state audits, and internal compliance reviews.

Compliance Dashboard

The built-in Compliance Dashboard tracks overdue items across every CMS Condition of Participation in real time:

Certification/census overdue alerts
Recertification expiration (14-day, 7-day, 1-day email alerts)
IDG cadence compliance (15-day cycle tracking)
Aide supervisory visit tracker (14-day window)
Bereavement contact compliance (13-month plan)
Volunteer professional hours (5% calculation)

CoP §418.x Module Coverage

CoP Section	CareNoteIQ Module
§418.54	Comprehensive Assessment (HOPE V1.00, iQIES XML export)
§418.56	Plan of Care with IDG ownership and version tracking
§418.58	Quality Assessment and Performance Improvement (QAPI)
§418.64	Bereavement Services (7-factor risk assessment, 13-month plan)
§418.72	Patient Rights (DNR/POLST upload, grievance intake, state hotline disclosure)
§418.76	Hospice Aide and Homemaker Services (visit tracker, supervisory alerts)

All clinical notes, HCTI narratives, and compliance records can be exported as PDF directly from the application — no export tool or developer access required. PDFs include document type, author, date, and digital signature status.

94 /100

Survey Readiness Score — Know your number before CHAP or Joint Commission walks in

A live 0–100 composite score computed from 13 weighted compliance domains. Green (≥90) means survey ready. Amber (75–89) means gaps to address. Red (<75) means immediate attention required.

13 weighted domains Nightly snapshots Surveyor PDF export Weekly digest

See your score →

Our Subprocessors

CareNoteIQ maintains BAAs with all subprocessors who access, process, or store ePHI. AI model providers (OpenAI, Anthropic) do not receive PHI — no BAA is required. Subprocessors are reviewed quarterly.

Subprocessor	Service	BAA Status	Data Accessed
Render	Application hosting, TLS	✓ Signed	Application code, session data; no PHI in logs
Supabase (PostgreSQL)	Primary database	✓ Signed	All ePHI stored in database
Postmark	Transactional email	✓ Signed	Recipient email addresses; no clinical content
OpenAI	AI text generation (HCTI drafts)	No PHI transmitted	De-identified/synthetic data only; PHI does not leave the HIPAA-covered environment before AI processing
Anthropic	AI narrative drafting	No PHI transmitted	De-identified/synthetic data only; PHI does not leave the HIPAA-covered environment before AI processing

AI Subprocessors — PHI Handling Policy

No PHI is transmitted to AI providers. All AI processing uses de-identified or synthetic data. BAAs with AI subprocessors (OpenAI, Anthropic) are not required because PHI never leaves the HIPAA-covered environment before AI processing. CareNoteIQ's architecture ensures PHI is processed and de-identified within the covered environment before any data is sent to external AI model providers.

Vulnerability Disclosure

We take security seriously and welcome responsible disclosure. No bug bounty program yet — just a real human who responds.

security@carenoteiq.polsia.app

Response commitments

48-hour acknowledgment SLA — we confirm receipt within 48 hours
7-business-day status update — investigation progress shared
Credit in security acknowledgments (opt-in) for responsible disclosure
No legal action against researchers acting in good faith

What to include in a report

Description of the vulnerability
Steps to reproduce
Potential impact
Any suggested remediation (optional)

Scope: the CareNoteIQ production environment and all first-party code. We do not accept reports for third-party libraries, CDN infrastructure, or end-user devices.

Where We're Headed — Honest Roadmap

We will not claim certifications we do not have. This page is updated when certifications are achieved, not when planned.

Certification	Status	Target
HITRUST	Under evaluation	No target date set
Annual Risk Analysis	Active	Completed annually

If your procurement process requires a specific certification not listed here, reach out: security@carenoteiq.polsia.app

Common Questions

Enterprise procurement asks the same five questions. Here are the answers.

Yes. CareNoteIQ operates as a HIPAA Business Associate and signs a Business Associate Agreement (BAA) with every covered entity we serve. We enforce the full HIPAA Security Rule: administrative safeguards (annual risk analysis, workforce training), physical safeguards (US-based Render infrastructure), and technical safeguards (RBAC, audit logging, AES-256 encryption at rest, TLS 1.2+ in transit).

All data is stored and processed exclusively in US-based infrastructure. Our primary database runs on Supabase (US East), hosted via Render (US Virginia). No data is transferred to, processed in, or accessible from systems outside the United States.

CareNoteIQ maintains immutable, append-only audit logs for all PHI access and modification events. Each entry captures: user, action, resource, timestamp, IP address, and session ID. Logs are retained for 6 years per HIPAA §164.308(a)(1)(ii)(D). No user role — including Superadmin — can modify or delete audit records.

AES-256 at rest (Supabase PostgreSQL), TLS 1.2+ in transit (auto-provisioned by Render, TLS 1.3 preferred), bcrypt cost factor 12 for passwords, and HTTP-only Secure cookies for session tokens. Encryption is enforced at the infrastructure layer — it cannot be disabled by any user role or configuration change.

Yes. The BAA flow is self-service at /baa. The BAA is executed before PHI is enabled on your account. If your legal team needs to review a draft BAA first, email security@carenoteiq.polsia.app.

Security & Compliance