Overview
In the United States, the Health Insurance Portability and Accountability Act (HIPAA) and its Security Rule govern how covered entities protect electronic protected health information (ePHI). Clinical photographs and the notes recorded alongside them are ePHI. This guide explains how Dermi Atlas Professional is designed to support the Security Rule obligations of dermatology and aesthetic practices, and which safeguards remain with the practice.
Dermi and the Business Associate Question
Under HIPAA, a business associate is a vendor that creates, receives, maintains, or transmits protected health information on behalf of a covered entity.
- Local storage: Dermi Atlas Professional stores patient records, clinical photographs, and the audit log on a computer the practice owns. No patient data is sent to Dermi; the complete list of what the software sends is in Data Security Architecture.
- No remote access path: The software gives Dermi no remote access to the deployment or its data. Assisted setup and data import assistance take place in a remote session that the practice starts and controls, as set out in the Dermi Atlas Assisted Services Terms.
Dermi's role and the data it processes are set out in the Dermi Privacy Policy, the Dermi Atlas Professional EULA, and the Dermi Sub-Processors document. The practice's privacy officer or counsel makes the resulting determination under HIPAA, including for any assisted setup or data import engagement.
Technical Safeguards
Access Control (45 CFR 164.312(a))
- Unique user identification: Every team member signs in under a named individual account with their own username and password, created only by claiming an invitation issued from Dermi Portal.
- Access by account type: Patient records belong to the practice team and are available to every member of it. Export, deletion, recovery, and patient identity edits are Clinician actions and are refused to Assistant accounts; the complete list is in Account Types and Permissions.
- Automatic logoff: A session ends after seven days without activity; the period is fixed and is not configurable. Each member can sign out one device or every device from Options => Account (Signed-In Devices, Sign Out Everywhere). Screen locks on the practice's tablets and computers cover shorter periods of inactivity.
- Immediate removal: An account is disabled at once from Administration => User Accounts in Dermi Atlas Manager, which ends its open sessions and refuses its sign-in.
- Encryption: Passwords are stored only as salted one-way hashes. Connections on the HTTPS address are encrypted with TLS 1.2 or TLS 1.3. Encryption of the host computer's disk and of backup copies is configured by the practice.
Audit Controls (45 CFR 164.312(b))
- Always recorded: Sign-ins and failed attempts, account security changes, and administrative actions are recorded at every logging level.
- Clinical activity: Under Comprehensive logging, the default, opening a patient record, creating, updating, deleting, and recovering records, viewing and generating PDF reports, downloading and exporting images, and recording or revoking consent are recorded.
- Entry detail: Each entry records the time, the acting account, the operation, the affected record, and the before and after values where applicable. Sign-in and account events also record the IP address, user agent, and timezone.
- Storage: The audit log is stored on the host computer and is included in every backup.
See Audit Logging Configuration.
Integrity (45 CFR 164.312(c))
- Confirmed deletion: Deleting a patient, image, zone, lesion, or session requires a typed confirmation phrase.
- Recoverable deletion: Under the Recoverable and Standard deletion policies, deleted records remain recoverable for the configured retention period; under Permanent, they are removed at once. See Configuring Data Retention for Deleted Records.
- Change history: Under Comprehensive logging, every change to a patient record is recorded with its before and after values.
- Backup integrity: A backup is verified for integrity before it is restored.
Person or Entity Authentication (45 CFR 164.312(d))
- Passwords: 12 to 256 characters, with a lowercase letter, an uppercase letter, a number, and a special character.
- Two-factor authentication: Optional and recommended, using a time-based one-time password (TOTP) authenticator app, with recovery codes issued when it is turned on. Skip 2FA for routine logins at sign-in skips the code on that device for 30 days.
- Sign-in alerts: Members receive email alerts for sign-ins and security changes, according to their Notification Settings.
Transmission Security (45 CFR 164.312(e))
- TLS on the practice network: Connections on the HTTPS address are encrypted with TLS 1.2 or TLS 1.3, using a certificate the deployment generates for the host computer, which is installed on each device. Clinical devices use the HTTPS address listed under Atlas Status => Atlas Access in Dermi Atlas Manager. The HTTP address is unencrypted; HTTPS is recommended wherever the network includes Wi-Fi or is shared. See SSL Certificate Setup for HTTPS Access.
Administrative and Physical Safeguards
The Security Rule's administrative and physical safeguards are the practice's policies; the features below support them.
- Information system activity review (164.308(a)(1)(ii)(D)): The Administration Activity drawer in Dermi Atlas Manager lists every sign-in and administrative action, filtered by Action, Performed By, and Period. Clinical activity is read per patient from the Patient Activity Logs drawer.
- Termination procedures (164.308(a)(3)(ii)(C)): Removing a member in Dermi Portal ends their access at the deployment's next check-in; disabling the account in Dermi Atlas Manager ends it at once. Neither deletes the records the member created.
- Data backup plan (164.308(a)(7)(ii)(A)): Backups are created from Backup Management in Dermi Atlas Manager and copied off the host computer with Export. Backups are not encrypted and hold every patient record and the deployment's keys, so exported copies are kept on encrypted storage. See Backing Up and Restoring Dermi Atlas Professional.
- Workstation and device controls (164.310): Full-disk encryption, physical access limits, and the disposal of old drives and backup media on the host computer are the practice's measures.
Incident Response and Breach Assessment
The Security Rule requires procedures for responding to security incidents, and the Breach Notification Rule requires a covered entity to assess a breach of unsecured protected health information and to notify affected individuals without unreasonable delay, and no later than 60 days after discovery, unless the assessment shows a low probability that the information was compromised.
Evidence available from Dermi Atlas Professional:
- Sign-in history: Every sign-in and failed attempt for an account, with IP address, user agent, and timezone, in the Administration Activity drawer with Performed By set to the account.
- Record access: Under Comprehensive logging, each patient's activity log shows who opened, changed, exported, or downloaded the record and when, and narrows to one member and period with the Member and Period filters. The log is read per patient; no view lists one account's clinical activity across every patient.
- Immediate containment: Disabling the account in Dermi Atlas Manager ends its open sessions at once.
Under the Essential level no clinical activity is recorded, and under the default Standard deletion policy the earlier entries of a deleted record are removed when it is deleted; the Recoverable policy keeps them for the retention period.
Checklist for Administrators
To support HIPAA obligations when using Dermi Atlas Professional:
- Confirm Comprehensive logging: Audit Logging ships set to Comprehensive; confirm it has not been changed to Essential under Administration => Settings in Dermi Atlas Manager.
- Consider the Recoverable policy: Choose Recoverable when the history of deleted records must be kept for the retention period.
- Secure the host: Enable full-disk encryption (BitLocker or FileVault) on the host computer and restrict physical access to it.
- Secure the network: Allow traffic only from trusted devices, use WPA2 or WPA3 on the practice Wi-Fi, and connect clinical devices through the HTTPS address.
- Encrypt backups: Export backups on a routine and keep the copies on encrypted storage, off site.
- Review access: Periodically compare the team members in Dermi Portal with the accounts under Administration => User Accounts, and review the Administration Activity card.
- Offboard promptly: When a staff member leaves, remove the member in Dermi Portal and disable the account in Dermi Atlas Manager when access must end at once.
Disclaimer: This guide describes software features and is not legal advice. Compliance with HIPAA is the responsibility of the practice, which should consult a privacy officer or legal counsel regarding its specific obligations.
Related Resources
- Security and Compliance Fundamentals for the shared responsibility model
- Data Security Architecture for what is sent to Dermi and the technical controls
- Audit Logging Configuration for configuring and reading the audit log
- Atlas Manager Administration for the admin passphrase, the account controls, and the deployment-wide settings