HIPAA Security & Readiness

PhysioFlow supports multi-factor authentication (MFA) for platform administrators and for clinic Owner/Admin accounts, using time-based one-time passcodes (TOTP) compatible with standard authenticator apps. Single-use backup recovery codes are provided for account recovery, and every enrollment, login, and recovery event is logged.

Access within PhysioFlow follows a minimum-necessary model. Pre-built role templates — Admin, Therapist, Reception, Accountant, and Therapy Aide — give each team member access appropriate to their function, and every clinic's data is securely isolated from other clinics through tenant-level access controls enforced by the platform.

Access is revoked immediately when a team member's account is deactivated — not on their next login. Cached patient information is cleared from the session on logout, and every authentication event is subject to automated monitoring for repeated failed attempts.

Backups are generated automatically and encrypted using AES-256-GCM authenticated encryption before being written to disk. Restore procedures are tested and verified. Data in transit is protected using industry-standard TLS encryption.

PhysioFlow maintains detailed audit logs covering authentication events, MFA enrollment and use, administrative actions, and account/security changes — giving clinics and PhysioFlow a clear, accountable record of activity.

Advertising and marketing tracking tools are technically restricted to public, pre-login marketing pages only. They are structurally excluded from every authenticated clinical workflow, so patient data is never exposed to advertising or analytics tooling.

PhysioFlow's AI-assisted features include an automated technical safeguard: for organizations identified as U.S.-based, real patient data is automatically restricted from AI processing until explicit administrative clearance is granted. Every clearance decision is individually logged for accountability, without logging patient data itself.

Production infrastructure uses key-based access only, automated firewall protection, and intrusion-prevention controls. Deployments follow a controlled process with automatic health checks and rollback if a release doesn't pass verification.

PhysioFlow maintains a documented Information Security Policy, a formal risk analysis and risk management process, an Incident Response Plan with breach notification procedures, access control and authentication policies, data retention and deletion procedures, and an active vendor/subprocessor review process.

PhysioFlow is committed to supporting HIPAA-eligible use by qualifying U.S. healthcare organizations, and is finalizing Business Associate Agreements with its technology vendors alongside its own Business Associate Agreement for clinic customers. If your organization requires a signed BAA, contact us at support@physioflow.com to discuss your specific requirements and current availability.