Security & compliance
You're the covered entity. We take that seriously.
Penna operates as your business associate under HIPAA and signs a BAA with every practice during signup, before an account exists. This page says what that means in the product and how we run the company behind it.
In the product
- Encrypted, in transit and at rest
- PHI is encrypted end to end; the app front end serves no patient data at all.
- Append-only audit log
- Creates, changes, signatures and disclosures are recorded where no code path can modify or delete them.
- Roles enforced server-side
- Clinical, billing and admin roles see different surfaces, checked on the server rather than hidden in the UI.
- Uploads malware-scanned
- Documents and inbound faxes are scanned before anything can be opened from a chart.
- Backed up daily, restorable
- Managed daily backups to versioned offsite storage, with a documented restore procedure.
- No AI training on your data
- AI drafts run in our own HIPAA-covered environment. Prompts and completions are never stored or used to train models.
How we operate
Business associate agreement
Every practice signs Penna's BAA as part of signup. It sets out our obligations for safeguarding PHI, breach notification, subcontractor flow-down and return or destruction of data at the end of service.
Named officers, by role
Penna designates a Security Officer and a Privacy Officer. Reach either through the role mailbox: security@penna.health and privacy@penna.health.
Incident response
A written incident response plan defines severity levels, a containment-before-diagnosis sequence, the four-factor breach risk assessment HIPAA requires, and the notification timelines we owe you as the covered entity. Incidents are logged and retained for six years.
Subprocessors
Penna uses a small number of infrastructure and service providers under business associate agreements of their own. A current list is available on request from the Privacy Officer.
Reporting a vulnerability
If you believe you've found a security issue, email security@penna.health. We acknowledge reports within one business day and will not pursue good-faith researchers who respect patient privacy and give us reasonable time to fix what they find. Please never include patient information in a report.
Privacy
How Penna handles information about practices and their staff, as distinct from PHI, is in the Privacy Policy.
Everything a compliance reviewer asks for, before the trial.
The Business Associate Agreement, Terms of Service and Privacy Policy are available to read before anyone signs, along with a written security summary and the current subprocessor list. Email security@penna.health to request the packet.
- Security summary: encryption, audit log, roles, backups, incident response
- Current subprocessor list, each under its own BAA
- BAA and Terms of Service to read in full before signup
- Who signs: the BAA needs someone with authority to bind the practice
Sign the BAA at signup. Then start.
Seven days free, no setup fee, and the agreement is in place before the first chart exists.
A person answers hello@penna.health, Monday to Friday, 8 AM to 5 PM Central. Business contact details only, please, no patient information.