Dermi Atlas Professional is designed with data sovereignty as a foundational principle. Unlike cloud-based imaging systems where data is stored by a third party, Dermi Atlas Professional uses a self-hosted architecture. This ensures that sensitive patient data, including clinical photographs, medical notes, and personal information, remains entirely under the practice's control on its own infrastructure.
This article provides an overview of how Dermi Atlas Professional acts as a tool to support a practice's compliance with healthcare privacy regulations, including HIPAA (United States) and PIPEDA (Canada).
The Self-Hosted Model & Data Sovereignty
The core of Dermi's security model is local data custody. Because the software runs on the local network, Dermi Inc. does not have access to, nor does it store, patient health information.
Data Stored Locally (Practice Responsibility):
- Patient photographs and clinical images
- Patient demographic information and notes
- Audit logs and activity records
- User account data
- System backups
Data Processed by Dermi (Vendor Responsibility):
- License verification and subscription status
- Software update checks
- Account security metadata (e.g., 2FA or password reset initiation)
Because Dermi Atlas Professional is deployed on the practice's own infrastructure and stores patient data locally, Dermi Inc. does not access that data as part of normal operations, and the practice retains ownership and control of it. The full description of Dermi's role and the data Dermi processes is set out in the Dermi Privacy Policy, the Dermi Atlas Professional EULA, and the Dermi Sub-Processors document. Practices should consult their privacy officer or legal counsel for the resulting determination under HIPAA, PIPEDA, and applicable provincial or state law.
Compliance Support Features
Dermi Atlas Professional provides technical features that allow practices to implement required administrative, technical, and physical safeguards.
Access Control
- Individual Accounts: Supports unique user identification.
- Strong Authentication: Enforces password complexity and supports Two-Factor Authentication (2FA).
- Session Management: Lets users end all active sessions across devices in a single action.
Audit & Accountability
- Activity Logging: Configurable logging levels track authentication, data access, and modifications.
- Granular History: Logs record the timestamp, the acting account, the operation, the affected resource, and the before and after states where applicable. Authentication and account events additionally record IP address, user agent, and timezone.
- Local Storage: Audit logs are stored locally and included in the system backups.
Data Protection
- Encryption in Transit: Supports TLS encryption for network communications via self-signed certificates.
- Safe Deletion: Configurable deletion levels (Recoverable, Standard, and Permanent) let practices choose how deletions are handled. Recoverable and Standard retain deleted data and stored files for the configured retention period and support in-app recovery of patients, entries, and images (Recoverable also retains the associated activity logs; Standard removes them). Permanent immediately and permanently removes data with no recovery. All deletion operations require explicit confirmation.
- Data Isolation: User accounts are isolated; users cannot view patient data belonging to other user accounts within the same deployment.
Consent Tools
- Workflow Integration: Configurable settings to prompt for consent before image capture.
- Documentation: Capabilities to record digital confirmation or verify external written consent.
Shared Responsibility Model
While Dermi provides the software tools, compliance is a shared responsibility.
Dermi's Responsibility:
- Maintain the software and publish updates, including security fixes, for delivery through Dermi Atlas Manager.
- Secure the administrative infrastructure (billing, licensing, account services).
Software is licensed under the Dermi Atlas Professional EULA.
Practice Responsibility:
- Physical Security: Securing the computer running Dermi Atlas Professional.
- Network Security: Configuring firewalls and securing the local network (Wi-Fi).
- Access Management: Creating accounts, managing passwords, and disabling access for terminated staff.
- Backup Strategy: Regularly running backups and storing them securely off-site.
- Policy & Procedure: Establishing and enforcing internal privacy policies.
Related Documentation
- Data Security Architecture: Technical details on encryption and ports.
- Audit Logging Configuration: How to configure and view activity logs.
- HIPAA Compliance Guide: Mapping features to US regulations.
- PIPEDA Compliance Guide: Mapping features to Canadian regulations.
- Configuring Data Retention for Deleted Records: Managing retention periods for compliance.
- Managing Patients for consent tracking and patient record management.
Disclaimer
Dermi Atlas Professional is a software tool that facilitates compliance; it does not ensure compliance by itself. Compliance depends on how the practice configures the software, secures the host environment, and enforces organizational policies. Dermi Inc. does not provide legal advice. Consult a compliance officer or legal counsel to ensure the deployment meets all applicable regulatory requirements.