Where we are today. Remitra is in private preview. We don't host any real patient data yet — every demo uses sample data. Before any practice goes live, we'll sign a Business Associate Agreement (BAA) with you, and the vendors that host or process patient data for us will have BAAs in place with us.
A note on "HIPAA certified"
There's no official HIPAA certification for software. Any vendor claiming to be "HIPAA certified" is using a marketing phrase. What matters is how a system is built, how it's run, and whether the company will sign a BAA. Here's how we approach all three.
How the platform protects patient data
Who can see what
- Role-based access. Every user has a role — provider, front desk, biller, coder, accountant, admin — and sees only what that role needs.
- Minimum necessary by default. For example, Social Security numbers are hidden from front-desk, billing, and coding roles.
- Separate practices stay separate. Every record belongs to one practice, and every request is checked against it.
- Patient portal kept apart. Patient logins can't reach staff features or data.
Signing in
- Two-factor authentication required for every staff account.
- Strong passwords — at least 12 characters, with complexity rules and password history.
- Lockout after repeated failed logins, and every failed attempt is logged.
- Automatic sign-out after 15 minutes of inactivity; sessions expire after 30 minutes and can be revoked instantly.
Encryption
- In transit: all traffic is encrypted with TLS (HTTPS), with HSTS enforced.
- Sensitive fields: Social Security numbers, bank connection tokens, and two-factor secrets are additionally encrypted with AES-256-GCM before they're stored.
Audit trail
- Every access to patient information is logged — who viewed or changed which record, and when.
- Audit logs can't be edited or deleted, even by administrators; the database blocks it.
- Seven-year retention for audit logs, in line with HIPAA documentation requirements.
Built-in safeguards
- Error messages are scrubbed so patient details never leak into logs or screens.
- Rate limiting and strict security headers protect against common attacks.
Our HIPAA program
- Business Associate Agreements. We'll sign a BAA with every practice before handling its patient data, and require BAAs from our own vendors that touch it.
- Written policies. We maintain documented procedures for breach notification, backup and recovery, data retention, and audit-log retention.
- Security reviews. We completed an initial security review and are completing a formal HIPAA risk analysis before launch.
Evaluating Remitra for your practice? We're happy to walk your compliance lead or IT partner through our safeguards in more detail — email hello@remitra.health.
Please don't email patient information
Regular email isn't a secure way to share health information. Don't send patient details to us by email or through this website. When a practice goes live, we'll set up a secure way to move data — after the BAA is signed.
Reporting a security issue
If you believe you've found a security vulnerability in Remitra, please email hello@remitra.health with the details. We'll acknowledge your report, keep you updated, and won't take legal action against good-faith research that avoids privacy violations and service disruption.