How we protect your practice's data
Your practice trusts us with claims, payments and a limited set of patient details. This page says plainly how that data is protected, what is in place today, and what we are still rolling out.
Practice Evolved reads your practice management system. The connection runs from a small program on a computer inside your office, outward to us. We never connect inward to your network, and your database credentials never leave your building.
The four things owners ask first
Not on our own, and never a figure we invented. We do not write a balance, a claim status, or any amount we calculated. Where you have asked us to, we can enter an insurance payment a payer has stated against the claim it belongs to, and your own software then recalculates exactly as it would if a member of your team had keyed the same payment, so a balance moves and a claim status can change. That is your software's arithmetic following from the entry, not a separate instruction from us, and we would rather tell you than let you find it. Every query the reading connection sends is still checked before it is sent, and anything that is not a read is refused, in code rather than by policy.
No. Credentials stay on the office computer that runs the sync program. They are never sent to us, never stored in our systems, and never appear in a log.
No. The connection is outbound only. The program in your office sends us what it read; nothing of ours dials in, so there is no port to open and no inbound rule to add.
Yes. Where we handle protected health information on a practice's behalf we act as a business associate under a written agreement with that practice, and the agreement governs.
What we read
The financial and operational side of your practice: insurance claims and their status, adjustments, accounts receivable balances, appointments and recall, provider production, and the reference data that makes those meaningful, such as your insurers and fee schedules.
So your own staff can work that data, a limited set of patient identifiers travels with an open claim: a name, and where it is needed to talk to a payer about that claim, a date of birth and a member number. Those reach your authenticated dashboard and nowhere else. They are never written to a log, an email or an export.
What we never read
Clinical charting beyond what a claim carries, imaging, Social Security numbers, and patient contact details such as home addresses and telephone numbers. We do not use practice data for advertising and we do not sell it.
What can be written back, and who decides
What the Service can write into your practice software is a short, named list, and clauses 5 and 6 of the Business Associate Agreement are the full description of it.
Today that list is a note. When your team writes a note in the dashboard, it can be posted back into the patient's record so the practice software stays the single record of what happened. On Open Dental that is on by default and your practice can turn it off at any time by telling us; on every other practice management system it is refused outright.
The agreement also permits one more, and it is off for every practice until that practice asks for it: entering an insurance payment a payer has stated, against the claim it belongs to. We enter what the payer said. We do not decide what you are owed and we do not write a figure we calculated.
Nothing else is written. Not a fee, not a treatment plan, not a clinical record, not a patient record, not a schedule, not a statement. We delete nothing and we change nothing a person at your practice entered. The write path is separate from every read path and cannot be reached from one.
How your data is protected
Encryption everywhere
Every connection to us is HTTPS using TLS 1.2 or newer. Our database and its backups are encrypted at rest with a key we control in AWS Key Management Service, rotated every year. Bank and accounting access tokens are sealed a second time with AES 256 before they are stored, and the program in your office signs in with a token we keep only as a hash.
Hosted on AWS in the United States
Practice Evolved runs on Amazon Web Services in the US East (Northern Virginia) region, under a business associate agreement with AWS. The database lives in a private network with no public address, and our own staff can reach it only through an access controlled tunnel tied to their AWS identity.
Access only for the people who need it
Each practice sees only its own data, and every request is checked against the practice that signed in; if that check cannot be made, the answer is no. Roles limit who can connect a bank, change settings or approve a write. Passwords are at least 12 characters and a session ends after 8 hours. Two step sign in with an authenticator app is available to every user as an option, turned on in Settings. We review every account with access to our systems each quarter.
Monitored and audited
AWS CloudTrail records activity in every region of our cloud account, with log file validation so a changed or deleted log is detectable. Every support session, bank connection change and write into your practice software is recorded in an audit log. Our logs carry reference numbers, counts and dollar figures, never patient details.
Vulnerabilities fixed on a clock
Automated dependency alerts and security updates are on for our code, our server image is scanned for known vulnerabilities every time it is built, and AWS patches the machines underneath. We fix critical issues within 14 days and high ones within 30. Every change passes our full automated test suite, and releases are built only from our main branch.
Backed up and recoverable
The database keeps seven days of point in time recovery plus a monthly snapshot kept for 90 days, all encrypted. The application is rebuilt from source on every release, and the program in your office keeps working while the cloud is unreachable.
HIPAA and the business associate agreement
We sign a Business Associate Agreement with every practice before any patient information reaches us, and the agreement governs. The protected health information we hold is a short, named list, it stays inside our AWS account, and it never goes into a log, an email or an outside AI service. If a breach of your patients' information ever happens, we tell your practice within ten business days of discovering it and give you what you need for your own notices.
Bank data through Plaid
If you choose to connect your practice's bank account so we can match insurance deposits to the payments payers report, that connection runs through Plaid. We use Plaid's Transactions product only, and it is read only: we can see deposits arrive, and we can never move money. Only an owner or manager at your practice can connect or disconnect a bank.
We keep only incoming deposits and insurance returns, never your bank login, your full account number or your ordinary payments. Deposit lines are kept on a rolling 24 months. When you disconnect, our access is removed at Plaid straight away, and everything we stored from that bank is deleted automatically within a day, and always within 30 days. Read more in our privacy policy and in Plaid's End User Privacy Policy.
Our written policies
Our security programme is written down, owned by a named founder, and reviewed every year. A practice can ask us for a copy.
Information Security Policy
Who is responsible, a yearly risk assessment, least privilege access with quarterly reviews, two step sign in, encryption, logging, our patch deadlines, how code is changed and released, the vendors we use, backups, and the baseline every work computer must meet.
Incident Response Plan
Four severity levels, a written runbook with switches that stop any write at once, notice to your practice within ten business days of discovering a breach as our agreement requires, notice to Plaid when bank data is involved, and a written review after every serious incident.
Data Retention and Deletion Policy
What we store, how long we keep it, and how it is deleted, including bank data on a schedule that runs by itself and the return or deletion of your data when you leave.
Report a vulnerability
If you believe you have found a security problem in Practice Evolved, email admin@practiceevolved.com with what you found and how to reproduce it. We will acknowledge your report within three business days and keep you informed until it is fixed. We will not pursue research done in good faith that avoids patient and practice data, does not disrupt the service, and gives us reasonable time to fix the problem before it is shared.
Questions we have not answered here
Real ones get a real answer from a person. The full legal detail is in the privacy policy, and anything it does not cover you can ask us directly.