You're handing me patient data. Here's how I treat it.

How your data is protected

Your data, handled as what it is.

To build your briefing, Dermhilda works with the data your practice already keeps in ModMed — and treats every bit of it as protected health information, because that's what it is. A Business Associate Agreement is in place before any of it is touched. That comes first, always.

From there, the posture is built in layers, on the deliberate assumption that any one safeguard can fail and the rest should still hold. Patient data is encrypted at every stage — AES-256 at rest, and encrypted in transit across a private, zero-trust network with no public-facing way in. Access follows the HIPAA "minimum necessary" standard: role-based, multi-factor at every entry, and tied to a named person for every action, with no shared logins. The machines our team works on are locked down so that patient data is never stored on them, and temporary working data is wiped on a fixed schedule rather than left to pile up. Everything is monitored around the clock, backed up in encrypted off-site copies, and governed by an incident plan that can revoke access and isolate a threat within the hour. And the whole program is put through a formal HIPAA security risk assessment every year, documented as a system of record.

The same separation that runs through the product holds here too: each provider sees only their own numbers, and what you work through with Dermhilda stays inside your practice.

That's the short version. The full posture — technical, physical, and administrative safeguards — is laid out in the security overview below.

The full posture

The safeguards, laid out.

We build on a deliberate assumption: any single safeguard can fail, so they're layered to back each other up. HIPAA sorts them into three kinds — technical, physical, and administrative — and so do we.

That's the posture, top to bottom. If your IT or compliance team wants the detailed version, it's a download away.

Our own posture

A defensible HIPAA posture is hard to build. We've already built one.

HIPAA compliance isn't a box you check once — it's a posture you stand up and keep: a real risk assessment, written policies, trained staff, signed agreements, and documentation you can actually produce when someone asks for it.

We've built exactly that for ourselves — the assessment, the policies, the training, the records, all run on AccountableHQ as our system of record.

If you don't become a client

We don't keep data we have no reason to hold.

If your practice takes a Practice Review and decides not to go further, we destroy your practice data within 90 days — the isolated environment we built for you goes with it. You can ask us to hold it longer while you decide, once, in writing. Otherwise it goes.

We'd rather rebuild from scratch later than sit on a practice's patient records hoping you come back.