Security
Klauve is built with features designed to support your practice in meeting its HIPAA obligations. The obligation stays yours — you are the covered entity — so this page sets out exactly what we do, in terms your IT reviewer can check.
Who opened which chart, when, from which address and on what device — and for a change, which fields moved. The trail is written by the server; there is no path from inside the product to edit or delete an entry, including for us.
The Security Rule asks for six years of documentation. Nothing expires on its own, and any date range can be pulled out as a spreadsheet for an auditor without asking us for it.
A code to the phone on top of the password. Everyone is asked to set it up when they sign in, and a practice can require it of its whole team. Once it is required, it is checked on the sign-in token by the identity provider, by our servers and by the database itself rather than by a screen the app puts in the way — so it cannot be stepped around by anything talking to our API directly.
Uploads, faxes and documents are never given a shareable URL. Every file is fetched through a check, made at that moment, that the person asking still works at that practice.
Removing a team member takes effect immediately, and shows in the trail. Their past activity stays attributed to them by name, so a record written three years ago still reads properly.
Served over TLS, and stored on Google Cloud, which encrypts data at rest by default. Google Cloud maintains ISO 27001 and SOC 2 Type 2 certification for its own infrastructure controls.
Handling protected health information on your behalf makes us your business associate. We will sign a Business Associate Agreement with your practice, and we would rather do it before you send us anything than after.
There is no such thing as a HIPAA certification, for us or for anyone else — any vendor claiming one is telling you something that cannot be true. What we can tell you is what the software actually does, which is the list above, and we are happy to walk an IT reviewer through it.
If you believe you have found a vulnerability in Klauve, email security@klauve.com. Tell us what you found and how to reproduce it, and please give us a chance to fix it before telling anyone else. We will acknowledge you within one business day.