Clinics record limited patient information in RxLedger, and we handle it on their behalf. These are the safeguards in place today.
We keep patient information to a minimum
RxLedger records only what a drug record needs: a patient's medical record number, plus name and date of birth at clinics that dispense take-home medications.
ProLogic Health staff never see a patient's full medical record number or date of birth.
No patient information is sent to AI services.
Encryption
The database and its backups are encrypted at rest with keys managed in AWS.
Data is encrypted in transit, and connections to the database verify the server's certificate.
Access control
Each person's role decides what they can see and change. Exporting patient identifiers takes a specific permission, and every such export is logged.
Web portal sign-in requires two-factor authentication.
On the iPad, a PIN locks after five wrong attempts.
Idle sessions end on their own: the web portal signs out after 15 minutes and the iPad locks after 1 minute.
A complete audit trail
Every transaction and change is recorded with who made it and when.
The application cannot delete audit records, and they are kept for at least six years.
Monitoring and backups
Security and system alerts go to a person, with a written record of each event.
The database is backed up on a schedule, and the backups are encrypted.
Agreements
RxLedger runs on Amazon Web Services, and our business email runs on Google Workspace. We have a Business Associate Agreement with each.
We sign a Business Associate Agreement with every clinic before it records patient information.
Questions about security or privacy?Email privacy@prologichealth.com and we'll answer, or share our documentation with your compliance team.