How we protect your record
Your health record belongs to you, and it is protected accordingly. This page explains who can open your record, how every view is recorded, and how the platform itself is built and run.
Who can open your record
- Only the people you allow can open your record
- A provider can see your record because you allowed it. When you end their access, it ends. There is no setting anywhere that overrides your decision.
- Every view is written down, and you can read the list
- Each time someone opens part of your record, their name, their role, what they opened, and when are recorded. You can see that list in your account.
- Access does not last forever
- If a provider has not opened your record in 30 days, their access ends on its own. A provider who needs a lasting copy downloads it while they still have access.
- Your complete record, whenever you want it
- Download everything from your own account: a folder of your documents and results, or a copy in the standard format other health systems can read. No forms, and nobody to ask.
Your account
- Two-step verification for any account
- Any account can add a second step at sign-in with an authenticator app, from Settings.
- You are signed out after 30 minutes away
- A record left open on a shared device should not stay open. After 25 minutes without activity you get a warning; after 30 you are signed out.
How the platform is built and run
myDxHub is built to the safeguards HIPAA requires. That is not a certificate, because none exists. It is how the platform is built and operated, and you are welcome to check it.
- Encrypted, stored and moving
- Your records are encrypted while they sit on our servers and while they travel between us and you.
- Built on services approved for health data
- myDxHub runs on cloud services approved for health records, under the signed agreement HIPAA requires of them.
- Practices and clinicians are checked against the federal registry
- When a practice registers or invites a clinician, their NPI, the federal provider number, is checked against the national registry. That confirms the number is real and matches the name. It is not a license check.
- A named person is responsible for security and privacy
- myDxHub has a designated Security Official and a designated Privacy Official. Reach the Security Official at security@mydxhub.com and the Privacy Official at privacy@mydxhub.com.
- Built to be usable by everyone
- The site and the record are built to the Web Content Accessibility Guidelines at Level AA. Our accessibility statement says what that means in practice, and what we know still falls short.
Report a security issue
If you have found a way to see data you should not be able to see, please tell us first. Email security@mydxhub.com, and include enough detail for us to reproduce it. Please do not include any patient data in your report. We read every report and reply to each one.
For the technically minded
The mechanism behind each statement above, for a practice’s IT team or anyone who wants to check our work.
- Access is enforced in the database
- Row-level security policies decide which rows each signed-in account can read. Ending a provider’s access changes what those policies return; the application never has the option of showing a row the database withholds.
- The access history is the audit trail
- Every read of a patient record writes an audit row stamped with the patient it belongs to. The list a patient sees in their account is a view of that same table, not a report prepared from it.
- Retention is by access, and it is visible
- Opening a record creates a 30-day claim on that record for the person who opened it. The claim is the row the patient reads under “What providers still hold”. Nothing is copied; nothing is snapshotted.
- Transport and storage
- HTTPS with HTTP Strict Transport Security on every response; encryption at rest for the database, for stored documents and images, and for backups.
- Infrastructure
- HIPAA-eligible AWS services under an executed business associate agreement. Access logs are archived hourly to write-once storage, hash-chained so a gap or an edit is detectable.
- Exports
- A ZIP of every document plus a JSON manifest, or a FHIR R4 Bundle, generated on request from the same policies that govern the screen.
- Provider identity
- NPIs are checked against the NPPES registry at registration and invitation, and every provider is screened against the OIG exclusion list on a schedule.