Security & HIPAA
Designed from day one for protected health information and addiction-treatment records.
Business Associate Agreements
BAAs with our customers and with every vendor that touches patient data: cloud, email, AI, e-signature, clearinghouse and EHR connections.
Encryption
Encrypted in transit and at rest, including backups.
Customer walls
Each center's data is isolated in the database itself, with automated tests proving one customer can't see another's data.
Audit log
Every read and change of patient data is logged with who, which record and when, never the values.
Access control
Role-based permissions, required multi-factor sign-in and automatic logout. Admissions never sees rates or margins.
Card data never stored
Cards go straight to a tokenizing payment processor. ERO keeps only the card type and last 4.
42 CFR Part 2
Consent and sharing rules for addiction-treatment records are built into intake and handoffs.
Retention and deletion
Data retention and deletion settings for each customer.
Made-up data in testing
Development and testing use made-up data only, never real patient records.
No certification is claimed.