Security

1. Data Protection

• Encryption at rest: Protected Health Information is encrypted in our database with AES-256, and in-app messages are encrypted at rest.
• Encryption in transit: all traffic between your browser or device and our servers uses TLS.
• Passwords: stored only as bcrypt hashes; we never store or see plain-text passwords.
• No PHI in notifications: push notifications on phones and lock screens do not include patient health information.
• Redacted logs and error reports: patient details are stripped from application logs and error reports before they are written or sent.

2. Access Control

• Role-based access: each user's role at each agency decides what they can see and do, so dispatchers, crews, billers, and administrators see only what their job requires.
• Agency separation: every agency's data is kept separate, and requests are checked so one agency cannot reach another's records.
• Multi-factor authentication: available to all users, and agencies can require it.
• Session protection: idle sessions time out automatically, and administrators can force password changes.
• Administrator control: agency administrators can suspend or remove a user's access at any time.

3. Audit and Monitoring

• Audit logs: access to patient records is logged with the user, time, IP address, and action, and audit logs are kept for at least 7 years.
• Monitoring: we monitor the Services for errors, unusual activity, and availability problems.
• Browser protections: a strict Content Security Policy and other security headers help block cross-site scripting and similar attacks.

4. Infrastructure

• The Services run on DigitalOcean cloud infrastructure in the United States.
• Server access is limited to authorized personnel using key-based authentication.
• Databases are backed up regularly so data can be restored after a failure.
• Software dependencies and the operating system are kept up to date with security patches.

5. Vendors

We keep the number of outside services that touch customer data small, and require a business associate agreement or equivalent written terms from any that may handle PHI. The full list is in our Privacy Policy, and how we handle PHI is on our HIPAA & BAA page.

6. Incident Response

If we discover a security incident affecting customer data, we investigate and contain it, and notify affected customers as our Business Associate Agreement and the law require: for a breach of unsecured PHI, without unreasonable delay and no later than 60 days after discovery.

7. Reporting a Vulnerability

If you believe you have found a security vulnerability in RescueLink EMS, please email us with a description and the steps to reproduce it. We ask that you:

• Give us reasonable time to fix the issue before sharing it publicly.
• Do not access, change, or delete data that is not yours, and stop and tell us if you encounter patient information.
• Do not degrade the Services for others, for example with denial-of-service or high-volume automated testing.

We will acknowledge your report, keep you updated, and will not pursue action against good-faith research that follows these guidelines.