How I handle your data
If you’re the person who has to sign off on letting an outside consultant near clinical systems, this page is written for you. It covers what a vendor security questionnaire usually asks, so most of your answers are here without a phone call.
I host no client patient data on my own infrastructure at any point. Your records stay in your systems of record, and I work inside them.
My work is advisory and investigative: I read configurations, trace how data moves, review contracts, and write documents. I do not run a platform for your data to sit on, and I do not take copies away with me. What does sit on my side is my own working files, kept on encrypted, single-user devices and in the backups described below.
What gets signed, and in what order
These four steps happen on every engagement, in this order, and none is skipped because a project is small or urgent.
Mutual nondisclosure agreement first
A mutual nondisclosure agreement precedes any systems walkthrough.
No patient data before a business associate agreement
I take no patient data or access to a system holding it before an executed business associate agreement. Any demonstration before that runs on de-identified or test data.
Minimum necessary access only
I get only the access the scoped work needs, and it ends when the work does.
Heightened handling for substance-use records
Records covered by 42 CFR Part 2, the federal rule for substance-use treatment records, are identified by you and handled under a qualified service organization agreement, the Part 2 counterpart to a business associate agreement.
The controls on my own equipment
I describe these by category rather than by product, because products change and an out-of-date claim helps no one.
- No client patient data on my infrastructure
- I host no client patient data on my own infrastructure at any point. Records stay in your systems of record, and I work inside them.
- Single-user encrypted devices
- Devices I own and use solely myself, with no shared or family use, each password-protected and secured with full-disk encryption.
- Multi-factor authentication and a password manager
- Multi-factor authentication is on for every account that supports it. Passwords live in a dedicated password manager on a locked device, never in a browser, and none is reused.
- Automatic patching
- All devices, including mobile, install operating-system updates automatically.
- Layered endpoint protection
- Commercial anti-malware and anti-ransomware software on every device.
- Encrypted mail in transit
- Email is sent over encrypted connections (TLS) between mail servers.
- Three-tier backup with an offline copy
- Working files are backed up in three places: on site, on a drive kept offline, and in a secured cloud account. Because one copy is kept offline, there’s a clean copy to recover from if ransomware reaches the others.
- No client data into untrusted AI tools
- I place no patient data into AI tools not covered by a business associate agreement, and no client-confidential data into any tool whose terms permit training on inputs.
- Subcontractors bound to the same obligations
- Subcontractors are rare. Where one is engaged, they are bound by contract to the same confidentiality and business associate obligations I hold, and you’d meet them before they touched anything.
What a one-person practice does not provide
Procurement reviews ask about each of these. The short answers are below.
No security operations center
I do not run a staffed, round-the-clock security monitoring function, for my own systems or for yours.
No round-the-clock support
Incident response and outage support are not part of any engagement. If you need someone on call at three in the morning, you need a managed service provider, and I’ll help you evaluate one.
No compliance determination
I will not tell you whether you are compliant with HIPAA or any other rule. I map your systems, trace where patient data goes, review what your vendor contracts allow, and give you the specific questions to take to counsel.
Certificate of insurance
If your procurement process needs a certificate of insurance before work starts, raise it in the first conversation so the timing is planned in.
This website collects almost nothing
If your security team has its own questionnaire, send it to hector@baselinehealthtech.com and I’ll complete it.