Security & compliance

Patient trust is the whole job.

The people you serve have more reason than most to worry about where their information goes. Here is how Sineobex protects it, in plain terms, so your compliance officer and your procurement team can check our work.

A business associate agreement, signed once

Your organization signs a business associate agreement (BAA) with Sineobex at sign-up, signed by someone with the authority to sign it.
Public and university programs that must use their own paper can, after counsel reviews it.
Each staff member accepts the terms of use and a confidentiality acknowledgement the first time they sign in.

In the cloud

Hosted on Amazon Web Services under AWS's own BAA.
Staff sign in with multi-factor authentication. Removing someone signs them out on every device at once.
The desktop web app works live against the server and keeps no patient data in the browser.

On the phone

Patient data on the phone is encrypted and opens with a PIN or biometrics. Ten wrong PINs destroy the key.
A lost phone can be wiped remotely. Its key is destroyed the next time it connects.
Photos and scanned documents stay inside the app and never reach the camera roll.
The app hides its contents in the app switcher and blocks screenshots on screens with patient data.
Notifications never include names or health details: "2 tasks due today", not a patient's name.
If someone's access is removed while their phone is offline, what it uploads later waits in a review queue instead of going straight into the chart.

An audit trail you can hand to an auditor

Sign-ins, chart views, edits, exports and admin changes are written to an append-only audit log.
The log is anchored in write-once storage (S3 Object Lock), so tampering would show.
Admins can search it and export it.

Minimum necessary, by design

Lists show a preferred name, a location and the one current need. Diagnoses and history are a tap deeper.
Roles decide which patients and screens each person sees. Sensitive sections, such as sexual and reproductive health and sensitive exams, need extra permission and never appear on the patient overview.
Patient ID links carry an opaque code and open only a sign-in page.
Exports are limited to admins and billing staff, need a fresh sign-in, carry a watermark and are logged.

Your data stays yours

Your organization can export its records at any time.
Billing exports go to the health center that bills for your team; grant reports contain counts, never names.

About “HIPAA certified”. There is no official HIPAA certification for software. A vendor can sign a BAA, put the required safeguards in place and show its work, which is what this page does. Sineobex is in development; we will publish updates here as safeguards are built and reviewed.

Accessibility

Under ADA Title II and the HHS Section 504 rule, health departments and HHS-funded clinics are responsible for the accessibility of the apps they use. We design Sineobex so that answer is easy.

WCAG 2.2 Level AA is the target for every screen, on iOS, Android and the desktop web app.
A High contrast theme with every text pair at 7:1 or better, alongside Day and Night run.
Large text without breaking. Screens reflow up to 200% text size.
Screen readers get a name and role for every control, with VoiceOver and TalkBack in mind.
Ready for translation. Every word in the app is built to be translated, for language access under ACA Section 1557.
An accessibility conformance report is being prepared for procurement reviews.

This website collects no patient information.

The waitlist form is for information about your team. Please don't include anything about patients in it.

Questions from your compliance team?

Join the waitlist and tell us what your review needs. We'll answer it before you commit to anything.

Join the waitlist