Security & Compliance

Patient trust is the product

An EHR holds the most sensitive data there is. Here's exactly how OnlineMed protects it — audited, certified, and in writing.

HIPAA Compliant

Administrative, physical, and technical safeguards aligned to the HIPAA Security Rule, with a signed BAA included in every subscription.

SOC 2 Type II

Independent annual audits of our security, availability, and confidentiality controls. Reports available to customers under NDA.

ONC 2015 Edition Certified

Certified to the ONC Health IT Certification Program (Cures Update), including the standardized FHIR R4 patient-access API.

How we protect PHI

Defense in depth, verified continuously

Encryption everywhere

AES-256 encryption at rest and TLS 1.3 in transit — for every chart, document, message, and backup, with keys managed in a dedicated KMS and rotated automatically.

Strong authentication

Mandatory MFA, SSO via SAML and OIDC, and hardware-key support for administrators. EPCS prescribing uses certified two-factor identity proofing.

Role-based access control

Granular permissions by role, location, and record sensitivity — including break-the-glass workflows and 42 CFR Part 2 segmentation for protected records.

Complete audit trails

Every view, edit, print, and export is logged immutably with user, time, and source IP. Audit reports export in one click for compliance reviews.

Resilient by design

Data replicated across multiple geographic regions with continuous point-in-time backups, a 15-minute RPO, and a tested disaster recovery plan.

Hardened infrastructure

Isolated tenant architecture, continuous vulnerability scanning, annual third-party penetration tests, and a 24/7 security operations team.

Your data, your keys

Full data export in standard formats (FHIR, CCD, CSV) at any time, at no cost. If you ever leave, your data leaves with you — cleanly and completely.

Vendor accountability

Every subprocessor is reviewed annually, bound by BAA, and published in our trust documentation. No patient data is ever sold or used for advertising.

Need a security review for procurement?

Book a call and we'll bring our security team, SOC 2 report, and completed questionnaires — everything your compliance officer needs.

Book a Sales Call View pricing