Each clinic kept apart
Server-side checks, PostgreSQL row-level security and database keys that cannot link records across clinics, three layers deep.
Security
Built to protect patient data from day one
Injury Books handles protected health information, so security is part of how it is built, not an add-on. Here is what protects your clinic's records today.
Role-based access
Administrator, front desk, provider and billing roles, enforced on the server. Money figures are removed for roles without billing access.
Encrypted SSNs
Social Security numbers are encrypted per field with AES-256-GCM, never sent to the browser in full, and revealed for 30 seconds at a time with a log entry.
Protected sign-in
Passwords hashed with scrypt, a six-digit code sent by email, and a 15-minute lock after five failed attempts.
Sessions that expire
Hashed, http-only session cookies that end after 12 hours. Pausing a clinic signs its staff out.
Append-only activity log
Views, changes, exports, sign-ins and admin actions are recorded in a log that cannot be edited.
Private file storage
Uploads are checked by file type and size, stored privately, and every access is authorized and logged.
No patient data in links
Patient details never go into web addresses or browser storage, and error logs hold no request data.
Daily verified backups
Each clinic is backed up every day, and every backup is checked with a SHA-256 checksum.
Questions from your compliance team?
We are happy to walk you through how Injury Books stores, protects and logs your clinic's data.