Security & Compliance
Protecting the patient information entrusted to OrthoDocs.
OrthoDocs is operated by Acqwired Inc. and is designed to support healthcare providers in managing patient referrals and related workflows securely.
When OrthoDocs creates, receives, maintains, or transmits Protected Health Information on behalf of a healthcare provider, Acqwired Inc. acts as a Business Associate under HIPAA.
We maintain administrative, physical, and technical safeguards designed to protect the confidentiality, integrity, and availability of electronic Protected Health Information.
Compliance
HIPAA
OrthoDocs is designed and operated to support compliance with applicable requirements of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the HITECH Act.
Acqwired Inc. enters into Business Associate Agreements with covered healthcare organizations as required. Our Master Business Associate Agreement governs the handling of PHI through OrthoDocs unless the parties execute a separate BAA.
Safeguards
How we protect information
Encryption
Electronic protected health information is protected using encryption in transit and at rest where appropriate to the OrthoDocs environment.
Access controls
Access to production systems and patient information is restricted according to role, authorization, and operational need.
Audit logging
OrthoDocs maintains logging and audit capabilities intended to support security monitoring, investigation, and accountability.
Secure cloud infrastructure
OrthoDocs production systems operate on Amazon Web Services infrastructure under a Business Associate Agreement with AWS.
Backup & recovery
OrthoDocs maintains backup and recovery controls designed to protect the availability and integrity of production information.
Risk management
Acqwired Inc. maintains a documented security risk analysis and risk-management process for systems handling electronic Protected Health Information.
Administrative safeguards
Security is more than infrastructure.
OrthoDocs maintains a security and privacy program that includes documented policies and procedures, workforce access management, security training, vendor oversight, incident response, contingency planning, and periodic review of risks to electronic Protected Health Information.
Service providers and subprocessors
We evaluate service providers that may create, receive, maintain, or transmit Protected Health Information on behalf of OrthoDocs and enter into appropriate written agreements where required.
Our current subprocessors are listed on our Subprocessors page.
Incident response
Acqwired Inc. maintains documented procedures for identifying, investigating, containing, mitigating, and documenting suspected security incidents involving OrthoDocs. When notification to a Covered Entity is required, we provide notification in accordance with applicable law and our Business Associate Agreement.
Responsible disclosure
Report a security concern
If you believe you have identified a security vulnerability or privacy issue involving OrthoDocs, please contact us promptly.
- Security
- security@getorthodocs.com
- Privacy & HIPAA
- privacy@getorthodocs.com
Please do not include patient information or other sensitive health information in an initial vulnerability report sent by ordinary email.
Questions from your compliance or security team?
We can provide additional security and HIPAA information to customers and prospective customers as appropriate.