Security at Cortexa

Access follows the role

A person answering an inquiry needs different information from a person working on a bill. Cortexa’s access policy limits what each person can see to what they need for their job.

Team members are required to complete confidentiality and HIPAA training before accessing patient information, with annual refresher training. Changes in roles or departures trigger an access review and removal through the account process.

In the analytics dashboard, you can show an ID code instead of a patient name. The default display uses a first name and last initial; the secure-ID setting removes those names from the management view.

Security requirements for the service

The security review explains how these requirements apply to your account and which supporting documents are available.

Storage, service providers and AI

Information from the practice’s EHR is stored in Amazon Web Services (AWS) data centers in the US. Companies handling patient information for Cortexa must have the appropriate agreements. We review which companies and systems are involved in the services your practice will use.

Cortexa’s standard business associate agreement, or BAA, promises that patient information will not be used to train AI models. Any permitted AI use must follow that agreement and the protections required of the provider. The HIPAA overview explains the agreement.

US storage describes where information is stored; it does not by itself describe where every authorized team member works. Include staff access requirements in the account review if your organization has location-specific restrictions.

What to bring to a security conversation

Tell us which service you are considering, your EHR and any requirements your organization follows that affect access, storage or vendors. Send your security questionnaire through the agreed process so answers can be tied to the actual service and supporting documents.

A useful review ends with a clear scope, access plan and agreement. It should also establish the contact for a suspected incident, how access changes are handled and what happens to information when the service ends. Your executed agreement governs the account’s contractual terms.

Keep the first contact free of patient records

Use the contact page to begin a security or service conversation. A description of your systems and requirements is enough for that first step. Login credentials, patient exports and screenshots containing patient information should use the secure process established for the account.