Overview
This article describes the security controls of Dermi Atlas Professional for IT administrators, practice managers, and privacy officers: where data is kept, exactly what is sent to Dermi, how connections and accounts are protected, and which safeguards the practice configures itself.
Local Data Custody
Dermi Atlas Professional runs on a computer the practice owns, on the practice network.
- Local storage: Patient records, clinical photographs, clinical notes, consent records, account passwords, and the audit log are stored on the host computer.
- No cloud copy: Patient data is never sent to Dermi and is never synchronized to a Dermi service.
- No remote access path: The software gives Dermi no remote access to the deployment or its data. Assisted setup and data import assistance take place in a remote session that the practice starts and controls, as set out in the Dermi Atlas Assisted Services Terms.
What Reaches Dermi
The items below are the complete set of data the on-premises software sends to Dermi. None of them includes patient records, clinical photographs, clinical notes, or the audit log.
- License activation: The license key, the installation identifier, the device fingerprint, the name of the host computer, and the acceptance of the End User License Agreement.
- License agreement: Installing Atlas, updating it, or restoring a backup from the installer also records the acceptance of the End User License Agreement with the installation identifier and the device fingerprint.
- License check: Atlas checks its license with Dermi at regular intervals. Each check carries the license and installation identifiers, a device fingerprint identifying the host computer, the team identifier, the version of the member list the deployment has applied, and the running Atlas version.
- Deployment Statistics: Each license check also carries aggregate totals for the deployment: the number of patients, images, tags, and team member accounts, and the total image storage size. Deployment Statistics is on by default and is turned off with the Deployment Statistics toggle in the Settings group of the Administration area in Dermi Atlas Manager, after which the check carries the Atlas version without the totals.
- Installation report: Dermi Atlas Manager reports when it starts and after it installs, updates, restores, or removes Atlas. The report carries the installation identifier, the device fingerprint, the Atlas and Dermi Atlas Manager versions, the host operating system name and version, the processor architecture, and the Docker version where available.
- Team membership: Dermi Portal holds each member's name, username, email address, account type, and membership status. When a member claims an invitation, the deployment sends the username and display name chosen at the claim. It also reports when an account is deleted on the deployment and when a member completes an email address change or an upgrade to a Clinician account issued from Dermi Portal.
- Account verification emails: Password change and recovery, two-factor authentication, and account deletion links are emailed through Dermi. Each request carries the member's email address, username, and first name, the request type, the link, and the details of the requesting device: its IP address, the IP address of the host computer, the public IP address of the practice network, the browser user agent, and the timezone.
- Sign-in and security notification emails: Sign-in alerts and security-change confirmations (password, two-factor authentication, email address, account details, recovery code use, and account deletion) are emailed through Dermi with the same device details. Each member chooses under Notification Settings on the Account page whether an alert is sent for every sign-in or only for essential security events.
- Update checks: Dermi Atlas Manager downloads release information and update files from Dermi. The requests carry no account or patient data.
- Diagnostics: Diagnostics are sent only when the operator opens Send Diagnostics from the Support drawer of Dermi Atlas Manager and selects Send. The bundle holds the Dermi Atlas Manager logs, the recent logs of the Atlas services other than those that store patient records and images, the software and operating system versions, the name of the host computer and its system details (hardware and Docker version), the deployment settings without passwords or keys, and any message the operator adds. Patient records and images are never included. A confirmation is emailed to the license owner, and the bundle is deleted after 90 days.
Separately, when a member signs in, claims an invitation, recovers a password, changes account details or security settings, or deletes their account, the browser looks up the public IP address of the practice network from checkip.amazonaws.com, an Amazon Web Services address. The address is recorded in the audit log and with the member's signed-in devices. The request carries no account or patient data.
Retention of this data is described in the Dermi Privacy Policy, and the locations where it is processed are listed in the Dermi Sub-Processors document.
Network Security and Encryption
Transport Layer Security (TLS)
Connections on the HTTPS address are encrypted with TLS 1.2 or TLS 1.3.
- HTTPS (port 15045): Encrypted between the host computer and client devices on the HTTPS address; a device that trusts the Atlas certificate connects without a warning.
- HTTP (port 15015): Unencrypted; HTTPS is recommended wherever the network includes Wi-Fi or is shared.
Self-Signed Certificates
Atlas is reached at a local IP address (for example 192.168.x.x) rather than a public domain, so a public certificate cannot be issued for it.
- Generation: A certificate specific to the host computer is generated when the deployment starts. It is regenerated automatically when it is invalid, within 30 days of its expiry, and when a regeneration has been scheduled from Dermi Atlas Manager.
- Trust: The certificate is installed on each client device so that browsers trust the connection. See SSL Certificate Setup for HTTPS Access.
Firewall Requirements
On Windows, Dermi Atlas Manager creates the required inbound firewall rules automatically, which requires administrator privileges. On macOS, configuration is needed only when the firewall is set to block all incoming connections, in which case Docker is the application to allow. On Linux, Docker Engine opens the Atlas ports itself and no host firewall rule is needed.
- Inbound rules: TCP traffic is allowed on ports 15015 (HTTP), 15045 (HTTPS), 15815 and 15845 (real-time sync), and 15000 (the certificate download for client devices). When a default port is already occupied, Dermi Atlas Manager selects an alternate; the ports in use are listed under Atlas Status => Atlas Access.
- Isolation: The host computer is best run on a private practice network, not a guest network.
See Firewall Configuration for the steps on each operating system.
Access Control and Authentication
The Team Model
A deployment holds exactly one practice team, and every clinical record on it belongs to that team.
- Every member of the team sees every patient, entry, and image on the deployment, which matches how a practice keeps one clinical record per patient.
- Each person signs in with their own account, username, password, and optional two-factor authentication. Every action is recorded under the person who performed it, and that record stays with the team after the person leaves.
- The account type sets what a member may do. Export, deletion, recovery, and patient identity edits are Clinician actions; the complete list is in Account Types and Permissions.
- Accounts are created only by claiming an invitation issued from Dermi Portal. Dermi Portal tells the deployment who is on the team and nothing more; it cannot read, change, or create clinical records.
Authentication Standards
- Password storage: Passwords are stored only as salted one-way hashes. Plaintext passwords are never stored.
- Complexity: Passwords are 12 to 256 characters long and contain a lowercase letter, an uppercase letter, a number, and a special character.
- Two-factor authentication: Optional and recommended. Codes come from a time-based one-time password (TOTP) authenticator app, and recovery codes are issued when it is turned on. A member can select Skip 2FA for routine logins at sign-in, which skips the code on that device for 30 days.
- Sessions: A session ends after seven days without activity and is extended while it is in use; the period is fixed. Each member reviews their devices under Signed-In Devices on the Account page and can sign out one device or all of them with Sign Out Everywhere.
See Account Security for the member-side steps.
Administration on the Host Computer
The deployment-wide settings, the immediate disabling of an account, and the deployment purge sit in the Administration area of Dermi Atlas Manager, behind an admin passphrase that never leaves the host computer. See Atlas Manager Administration.
Backups
Backups are created, exported, and restored from Backup Management in Dermi Atlas Manager. The security facts are:
- Contents: A backup holds every patient record and image, the audit log, and the deployment settings, including the deployment's keys.
- Integrity: A backup is verified for integrity before it is restored.
- Location: Backups are kept in a fixed folder inside the Dermi Atlas Manager data folder on the host computer.
- No encryption: Backups and exported copies are not encrypted.
- Export: Export writes a backup to a chosen folder as a single
.tar file.
Custody: Exported copies belong on an encrypted drive or an encrypted storage service the practice has vetted, kept off site and under access control.
The steps are in Backing Up and Restoring Dermi Atlas Professional.
Host System Hardening
Dermi Atlas Professional relies on the security of the host computer, so the practice applies these measures:
- Disk encryption: BitLocker (Windows) or FileVault (macOS) protects data at rest if the computer is stolen.
- Operating system updates: The operating system is kept patched.
- Physical security: Physical access to the host computer is limited to authorized staff.
- Administrator accounts: Administrative control of the host computer is limited to the people responsible for it, since that control reaches past the admin passphrase.
Related Resources
- Security and Compliance Fundamentals for the shared responsibility model
- Audit Logging Configuration for what the audit log records and how it is read
- Atlas Manager Administration for the admin passphrase and the deployment-wide settings
- Firewall Configuration for the port rules on each operating system