How we protect patient information.

A wall around every company

Many companies run on one PMXPlatform, and each is separated at every layer, not just by a filter in the code.

• At sign-in. Each sign-in carries its company, set when the account is made. Nobody can change it, not even an admin.
• In the database. Row-level security refuses another company's rows whatever the application asks for, and the application's own database login can't switch that off. Every new kind of record must ship with that rule and a test proving a second company can't see it.
• In how companies are made. A company is created or changed only from a reviewed file, never from a screen, and is switched on only after its business associate agreement is signed.
• In AWS. Production, development, backups and logs each live in their own AWS account.
• In what each company controls. Its own admins, audit trail, Microsoft sign-in and AI switch.

Each person sees only their part

Facility nurses see their facility's exams. Techs see the exams assigned to them. Radiologists see their reading group's studies. Billing sees done exams to bill, never images or reports. Someone who asks for a record outside their part gets "not found", so record numbers can't be probed. People who hold two jobs pick one at a time, and the audit trail records which.

Every look is written down

Each view, list, change, signature, export, sign-in and refusal is recorded with who, when, from where and which patient. The trail can only be added to: nothing in the application can change or delete it, and a daily copy goes to locked storage for seven years. Compliance staff can run a patient's access report in a minute.

Sign-in and admin rights

• Multi-factor sign-in for every account, or sign-in with your company's Microsoft accounts so your IT keeps the passwords and MFA.
• Short sessions, and an idle browser signs itself out.
• Admin rights are off until an admin signs in again and turns them on, and they end within the hour.
• An admin helping someone can view the app as them, read-only, with a reason, and the audit trail names the admin.

What we keep, and what we don't

• No Social Security numbers, anywhere.
• The Medicare ID is encrypted on its own, shown masked, and revealed only with a reason that is audited.
• Logs hold no patient details: no request bodies, no search text.
• A signed report is never edited. Corrections are addenda.
• The tech's phone keeps its offline copy encrypted and wipes it on sign-out.

Where it runs

On Amazon Web Services in the United States, using only HIPAA-eligible services in production, in separate AWS accounts for development and production. Development holds made-up data only, forever. Data is encrypted in transit and at rest, backed up daily, and copied to a locked vault in a second region that nobody can delete early. Restores are tested every month. The AI features use Claude through Amazon Bedrock, inside AWS, so patient details never go to an outside AI service.

How changes get made

Every change goes through automated tests and an AI security review. Changes to sign-in, access rules, the audit trail, the database or the cloud setup are flagged for a second person's review.

Agreements

We sign a business associate agreement with every customer before any patient data goes in, and a company's account is switched on only after its agreement is signed. Subcontracted techs get access only while their company's agreement is in force.

What we haven't done yet

We would rather you hear it here. PMXPlatform has not yet had an independent penetration test or a SOC 2 audit. Both are planned before outside companies go live, and this page will say so the day each is done. Ask us for the current state at any time.

Security questions or a report of a problem: info@pmx-ray.com