Security
What PayerHarbor does to protect the information you put in it. Every statement on this page is true of what is running today.
A business associate agreement with every customer
Credentialing runs on practitioner and business information, and PayerHarbor never asks for patient information. But the documents and notes you add may name a patient. So we sign a business associate agreement with every customer. It is part of the terms you accept when your account is set up.
What is stored
- Information about your practitioners, your organization and the practices you work for.
- Patient information only when you put it in a note or a document yourself. The product never asks for it.
Where it runs
PayerHarbor runs on Amazon Web Services, in an AWS account that holds PayerHarbor and nothing else. That account is covered by AWS's Business Associate Addendum. Your information is kept only in that account.
Encryption
Everything is encrypted when it is stored and when it is sent. The product and this website work over HTTPS only. The database, its disk and its copies are encrypted with a key that PayerHarbor controls.
A record of every action
Every action in the hosting account is recorded, and the record is kept for six years. It is locked against deletion, and any change to it can be detected. Inside the product, sign-ins, refused sign-ins and changes to accounts, roles and settings are recorded too.
Copies of your information
The database is copied every night, and each copy is kept for 35 days. The disk it lives on is copied every day. A copy has been restored onto a separate server, and every row was checked against the copy, to prove that a restore works.
Your organization's information is kept apart
Each organization sees only its own information. Each person in it has a role: administrator, specialist or viewer. The role decides who may change what. Only administrators manage the team and the settings, and download everything at once.
If something goes wrong
We follow a written breach notification procedure. If your information is affected, we tell you without unreasonable delay, and no later than 60 days after we find out.
Questions
Write to support@payerharbor.com, which a person reads. A longer security overview is available to customers and to organizations deciding whether to use PayerHarbor. Ask for it at the same address.