Built HIPAA-aware from day one.
Protecting your clients’ health information isn’t a feature we bolted on. It’s how the platform is built, from encryption and audit logging to access controls throughout.
HIPAA-aware by design
Built from the ground up for protected health information, not retrofitted onto a generic CRM.
Encrypted everywhere
Your data is encrypted in transit and at rest. Files live in HIPAA-aware storage with server-side encryption.
Full audit trail
Clinical actions and record changes are captured in a complete audit trail you can review.
Provider MFA
Two-factor authentication is required on every provider account, so a leaked password isn’t enough to get in.
Idle auto-lockout
Sessions lock themselves after inactivity, so an unattended screen never leaves health information exposed.
You control who joins
Clients get accounts only through your invitation or your booking link, which you control. There’s no open public sign-up.
PHI-conservative by default
Emails and notifications minimize identifiable health information, and PHI is scrubbed from logs and error reports.
Your data, always yours
Export charts and records anytime, backed by a public data-retention policy and self-serve account deletion.
How we protect your data, in plain language.
This is the short version of Exhibit A: Security Measures in our Terms of Service. The exhibit is the binding version; this page is here so you can read it without a lawyer.
Security governance
We run a written, risk-based security program: periodic risk assessments, written security policies, and a written incident response and breach notification plan. Everyone with access to customer data completes security and privacy training when they start and again every year. Incidents are reported as HIPAA and your BAA require.
Access control
Every provider account requires two-factor authentication. Access is role-based, each practice’s data is logically separated from every other practice, and access to customer data is limited to the people and systems that need it, enforced by automated controls. Clients get accounts only through their provider’s invitation or booking link; there’s no open public sign-up. Passwords are never stored in plain text.
Encryption
Your data is encrypted in transit with industry-standard protocols and encrypted at rest with industry-standard algorithms, including uploaded files.
Secure development
Automated security testing runs before every deployment, and known vulnerabilities in production dependencies are scanned for and fixed on an ongoing basis. Controls keep sensitive data out of logs and diagnostic tools. We run periodic internal security reviews. The platform was independently penetration tested by Software Secured (web application, API, and external infrastructure, September 14 to October 1, 2026, with every finding verified fixed in a retest on October 13), the attestation letter is available on request, and that test is repeated every year.
Monitoring
We watch the platform for errors and security-relevant events with tooling designed not to expose sensitive data, and we rate-limit sign-in and other authentication endpoints to resist automated and credential-based attacks.
Resilience and data lifecycle
The platform runs on managed cloud infrastructure with regular encrypted backups and recovery capabilities built for business continuity. Our Data Retention Policy governs how customer data is kept, exported, and securely deleted.
Subprocessors
Every vendor that stores or transmits customer data on our behalf signs a written agreement with data-protection obligations that match this program and, where PHI is involved, HIPAA business associate terms.
Physical security
Our infrastructure is hosted by major cloud providers that hold independent third-party certifications such as SOC 2. We don’t run our own data centers.
Read the full exhibit in the Terms of Service. See also the Business Associate Agreement and the Data Retention Policy.
Found a security issue? Email security@soloisthealth.com.
Security questions, answered.
Is SoloistHealth HIPAA compliant?
It's built HIPAA-aware from the ground up — designed for protected health information, not retrofitted onto a generic tool. That means encryption in transit and at rest, a full audit trail of clinical actions and record changes, required two-factor authentication on every provider account, idle auto-lockout, and PHI kept out of logs, error reports, and email previews. One honest note: HIPAA has no official certification, so treat any tool advertising itself as 'HIPAA certified' with caution — what matters is whether the safeguards are actually in place.
Do you provide a Business Associate Agreement (BAA)?
Yes. When you use SoloistHealth to handle your clients' protected health information, we act as your business associate. The BAA is entered into when you create your provider account and accept the Terms of Service, and you can read it at any time on our Business Associate Agreement page.
Has SoloistHealth been independently tested?
Yes. Software Secured, an independent application security firm, performed a comprehensive manual, authenticated penetration test of the SoloistHealth web application, API, and external infrastructure from September 14 to October 1, 2026, aligned with the OWASP Top 10, OWASP API Top 10, OWASP Web Security Testing Guide, and NIST guidance. Every finding was remediated and verified as fixed in a retest on October 13, 2026. Software Secured's attestation letter is available on request. Testing is repeated every year, on top of automated security testing before every deployment and ongoing scanning of production dependencies. Everyone with access to customer data also completes HIPAA security and privacy training every year.
Is my data encrypted, and where is it stored?
Your data is encrypted both in transit and at rest, and files are kept in HIPAA-aware cloud storage with server-side encryption, on US-based infrastructure.
Who can access my clients' information?
Only you and the clients you bring in. Clients get accounts only through your invitation or your booking link, which you control; there's no open public sign-up, and each client sees only their own records. Every provider account is protected by required two-factor authentication and locks itself after a period of inactivity, so a leaked password or an unattended screen isn't enough to expose anything.
What happens to my records if I cancel?
They stay yours. You can export your charts and records at any time. If you close your account, you get 30 days to change your mind, a complete export is emailed to you the moment you confirm, and clinical and billing records are kept securely for 6 years and then permanently deleted. The details are in our public Data Retention Policy.
Do you sell my clients' data?
Never. Your clients' health information is yours — it isn't sold or shared for advertising, full stop.
Security you don’t have to think about.
Free for your first 3 clients. No credit card. Cancel anytime.