Data Security & HIPAA
Handling clinical records is the first question a practice manager asks. Here's exactly what we store, what we scrub, and the compliance posture behind EarnedMD.
EarnedMD makes a Business Associate Agreement (BAA) available to covered entities. Practices acknowledge the BAA during onboarding, before uploading any clinical chart. If your practice needs a signed BAA on file, contact us and we'll get one in place.
Each practice's data is isolated at the organization level. Your encounters, findings, and reports are never visible to other practices on the platform.
As a safety net, EarnedMD automatically scans every uploaded text record and scrubs common ePHI — names, dates of birth, SSNs, MRNs, addresses, and phone numbers — before any analysis runs. Please remove patient identifiers before uploading whenever possible; the scrubber catches what's missed.
EarnedMD is hosted on enterprise-grade cloud infrastructure with redundant, monitored environments designed for high availability.
All data is encrypted using TLS during transmission and encrypted at rest in storage, protecting it end-to-end.
Before any analysis runs, every uploaded record is automatically scanned and scrubbed of identifiable patient information — names, DOBs, SSNs, MRNs, addresses, and phone numbers.
Each practice's data is isolated at the organization level. Your encounters, findings, and reports are never visible to other practices.
The platform undergoes regular automated security scanning to identify and remediate vulnerabilities, with security headers enforced across all endpoints.
You can delete encounters and audits at any time. We don't keep your clinical records longer than you need them.