Patient data, protected before the first record arrives.
Encryption, required two-factor sign-in, a tamper-proof audit trail and a signed BAA are in place before your workspace holds a single chart. Here is how each one works — and nothing we haven't done.
Encryption
Every page, form and API call travels over HTTPS, and database connections require TLS. Integration keys, connection strings, uploaded chart files and import exports are encrypted with AES-256-GCM before they are written, and our database provider, Neon, encrypts stored data at rest.
Required two-factor sign-in
Anyone who can open a chart or change users, settings or integrations must sign in with a code from an authenticator app; new practices require it for every staff member by default, and people without it are walked through setup at their next sign-in. Patients and families can turn it on for their portal. Every THNK console account must use it. Passwords are kept only as bcrypt hashes and session tokens only as hashes.
Audit log that can't be edited
Sign-ins, failed attempts, lockouts, record changes, permission changes, exports and every chart view, print, download and edit are logged with the user, the record, the time and the IP address. The database refuses edits and deletions of these logs — even from an owner — and they are kept at least six years. Practices can report PHI access by user or by patient and export it.
Signed BAA before any PHI
The Business Associate Agreement is accepted in the application, before your workspace exists and before a single file can be uploaded. We record the signer's name and title, the time, the IP address, the agreement version and a fingerprint of the exact text accepted.
Automatic sign-out
Idle sessions end on the server after 15 minutes for staff (each practice can set 5 to 60) and 30 minutes for the patient portal, with a two-minute warning and a "stay signed in" button. Every session ends after 12 hours regardless.
Lockout protection
Repeated failed sign-ins lock the account for longer each time and the account holder is emailed. Floods from one network address are locked out too. The limits are stored in the database, so they hold across every server.
Breached-password screening
Passwords need at least 12 characters, can't reuse the last five, and are checked against known breached passwords using a k-anonymity lookup, so the password itself never leaves our servers. Temporary passwords must be changed at first sign-in.
Extra encryption for sensitive identifiers
Insurance member IDs, tax IDs, DEA numbers and psychotherapy notes are encrypted again inside the database with AES-256-GCM, with versioned keys that can be rotated.
Emergency access, fully logged
A staff member without chart access can open one chart read-only for an hour in an emergency after stating a reason. Owners and the practice's security officer are alerted immediately, every page opened is logged, and each use is reviewed.
Backups and recovery
The database keeps point-in-time history, so it can be restored to a moment before a problem. Our written recovery plan targets restoring service within 72 hours, and restores are rehearsed with a test script. Signed notes, orders and consents are re-verified against their signature fingerprints every night.
A compliance program, for us and for you
Everyone with THNK console access acknowledges our HIPAA policy at first sign-in and every year. Each practice gets the same tools inside the app: security and privacy officer designation, workforce policy acknowledgment, a risk analysis worksheet, an incident log with breach assessment and notification deadlines, quarterly access reviews and an asset inventory.
Least-privilege access
Roles carry specific permissions — viewing contacts, editing the calendar, seeing financials — and any one user can be granted or denied a permission on top of their role.
The most sensitive records, handled separately
Where a practice turns them on, psychotherapy notes live in their own encrypted table with a separate access log and are never printed, exported or shown in the portal. Substance use records flagged under 42 CFR Part 2 need a consent with every required element before they can be exported.
E-prescribing through a certified partner
Prescriptions are written in DoseSpot inside the chart. DoseSpot holds the Surescripts and EPCS certifications, and each prescriber completes identity proofing and two-factor setup with DoseSpot. We do not claim those certifications ourselves.
No PHI in our email
Emails we send about your account — welcome, billing, support — contain no patient information. Clinical communication stays inside the app.
Your data leaves with you
Ask for a complete export of your records at any time, and any single chart can be downloaded as a FHIR R4 bundle from inside the app. When the agreement ends, we return or destroy your data as the BAA describes.
What stays with your organization
HIPAA compliance is shared. We secure the platform; your organization decides who gets access and how it is used.
- Inviting users, assigning roles, and removing access when staff leave
- Keeping two-factor sign-in on for everyone (it is on by default)
- Your own HIPAA policies, risk assessment and workforce training — the app gives you the tools to run and record them
- Signing BAAs with any outside service you connect yourself (email, text, AI, video); until you record one, the app won't send patient information to it
- Keeping PHI out of free-text fields that are shared outside the app, such as public website forms
Our subprocessors
The outside services THNK Med runs on or connects to. A Business Associate Agreement is required before any of them may store or process patient information.
| Service | What it does | Patient information |
|---|---|---|
| Vercel | Application hosting | BAA required before PHI |
| Neon | Database hosting | BAA required before PHI |
| DoseSpot | E-prescribing inside the chart | BAA required before PHI |
| Telnyx | Text messages and phone calls, when a practice turns them on | BAA required before PHI |
| Daily | Video visits, when a practice turns them on | BAA required before PHI |
| Anthropic or OpenAI | Optional AI assistant | BAA required before PHI — without one the assistant runs in a private mode that sends no patient information |
| ElevenLabs | Optional assistant voice | BAA required before PHI — voice is off on staff and portal screens without one |
| Resend | Account email (welcome, billing, support) | None — our email carries no patient information |
| Stripe | Card payments | None beyond what a payment needs |
Questions from your compliance officer are welcome.
Start a trial — the BAA is part of signup — or book a call and bring your questionnaire.