Common Security Questions About TherapyAppointment

All data that is shared with TherapyAppointment is stored and processed in North America

Servers and networks reside in US-based data centers within the Amazon Web Service (AWS) cloud. Core staff are located in the US and Canada. Third-party data processors that integrate with the TherapyAppointment portal are also US and Canada-based, and our contracts with these processors require that customer data remain within the United States.

Privacy and security standards extend to third-party relationships

TherapyAppointment conducts reviews of third party software and computing vendors to ensure that they satisfy compliance requirements and are equipped to provide a similar level of protection to customer content. All third party vendors that store, process, access, or manage PHI on TherapyAppointment’s behalf are required to enter into a HIPAA Business Associate Agreement that extends the privacy and security standards required by the application.

TherapyAppointment maintains formal security and compliance governance

TherapyAppointment has designated a Chief Information Security Officer and a Privacy Officer responsible for our security and privacy programs. We maintain a documented incident response plan, a business continuity and disaster recovery program, and a formal risk management program, each reviewed at least annually. Our risk management program operates continuously, incorporating a comprehensive risk assessment performed no less than once per year along with ongoing targeted risk analyses triggered by operational, technical, or regulatory changes, to identify and prioritize the risks we address. Additional documentation about our HIPAA safeguards and compliance program is available to customers upon request.

TherapyAppointment does not directly handle cardholder data

TherapyAppointment does not directly handle, process, store, or transmit cardholder data. Payment functionality is provided exclusively through PCI DSS-validated, processor-hosted components, keeping cardholder data out of TherapyAppointment’s own systems.

TherapyAppointment validates its own PCI DSS compliance annually through a Self-Assessment Questionnaire.

TherapyAppointment commits to prompt notification if a security incident affects your data

If TherapyAppointment discovers a security incident affecting your data, we notify you within 30 days of discovery, unless a shorter timeframe is required by applicable state law

Servers and networks leverage redundant designs to maximize availability

All servers and networks are distributed across at least two AWS availability zones to limit the risk of application downtime. File and database content for our systems is replicated automatically by AWS across three availability zones.

Customer content is protected by a multi-layer backup strategy

Customer content and other critical data is backed up nightly to Amazon-managed storage within the same region and retained for a minimum of 35 days. For most types of information, this allows a point-in-time restore to any moment within that 35-day window.

In addition to these backups, customer data is replicated to a geographically distant AWS region as part of our disaster-recovery program.

TherapyAppointment leverages industry-standard encryption to protect data in transit or at rest.

Where possible, we leverage native AWS encryption, built on FIPS 140-3 validated hardware security modules where applicable. We retain control over the encryption keys used by AWS for encryption. 

All customer content is covered by at least one layer of 256-bit AES encryption (AES-256-GCM) at rest. For particularly sensitive content, such as clinical note text, a second layer of encryption is applied within the application before data reaches our database, so that content is not accessible in readable form through the database directly.

Client-facing network traffic is encrypted using TLSv1.2 or higher, with a restricted set of protocols and cipher suites that support forward secrecy.

TherapyAppointment conducts regular scans for its system and network

External vulnerability scans are performed at least quarterly, within continuous automated scanning of internal systems between assessments. An independent third party conducts a full penetration test of our external network, internal network, and web application at least annually to assess for weaknesses and identify software dependencies that may require updates.

TherapyAppointment uses AI responsibly, without training on your data

TherapyAppointment offers an optional AI-assisted clinical documentation feature. AI-generated content is always a draft that requires clinician review before it becomes part of the clinical record. Protected health information is never used to train or fine-tune AI models: our AI features use commercially available foundation models under contracts that prohibit the third-party provider from retaining or training on submitted data. Workforce members must complete responsible-AI training before they are granted any access to production systems or protected health information. 

TherapyAppointment retains and disposes of your data under your direction

Retention and disposal of customer records is governed by the terms of our Terms of Service and Business Associate Agreement. Consistent with TherapyAppointment’s role as a HIPAA Business Associate, we do not independently decide to delete or restrict access to customer-owned records without the practice’s authorization. 

TherapyAppointment does not use your data for purposes outside your agreement with us

TherapyAppointment does not de-identify or aggregate customer data for use outside of your agreement with us, including for advertising, marketing, or resale to other parties.

Security and privacy are part of woven into the application design and development

TherapyAppointment’s core values include respecting provider control of their data and protecting the confidentiality and security of patient data. These values actively drive decision-making about the product and are actively evaluated when considering new features. 

TherapyAppointment has established software security standards and development processes to reduce the risk of critical vulnerabilities being introduced in our software.

TherapyAppointment screens and trains its workforce

All workforce members complete a background check, including criminal history screening, before beginning employment. Workforce members also complete privacy and security training upon hire and at least annually thereafter, including training on recognizing phishing and social-engineering attempts.

TherapyAppointment secures the devices and access our own workforce uses to support your account

TherapyAppointment workforce devices are enrolled in mobile device management with enforced full-disk encryption and continuous device-trust verification. Access to production systems requires a zero-trust network connection rather than a traditional flat VPN, limiting each workforce member’s access to only the systems and data they need.

TherapyAppointment provides customers tools to secure their own use of the system

We require customers to assign unique users and passwords to each member of their team, while providing free accounts for non-clinical staff to encourage compliance. TherapyAppointment provides multiple job-based roles and permissions enabling practice owners to grant the right level of access to each user in their account. 

All users are required to set a 12-character or stronger password and are encouraged to add additional protection to their account using multi-factor authentication. Passwords are never stored in plain text; they are protected using modern, industry-recommended hashing. Customers are provided access to audit logs, including up to 90 days of login history viewable directly within the application, which can be used to monitor logins and other activity within the practice and identify potential misuse. 

Practice account owners also have the ability to configure and enforce security and compliance settings for their staff, including:

• Automatically sign users out after a period of inactivity (up to 2 hours)
• Require multi-factor authentication
• Disable accounts automatically after 90 days of inactivity

For advanced use-cases, we offer options and support for logging into TherapyAppointment through external identity providers using OIDC (such as Okta or Microsoft Entra).