Our Approach to Patient Data Security

Patient data security in healthcare imaging is not simply a matter of encryption and access controls. It begins with a fundamental question: where does the data live, and who controls it? Dermi Atlas was architected around the principle that patient imaging data should remain within the clinical environment that creates it.

Where Patient Data Is Stored

Dermi Atlas Professional is deployed on infrastructure owned and operated by the healthcare practice. Patient images, records, and metadata are stored locally. Administrative traffic, such as license verification with aggregate deployment totals, team member records, software updates, and password recovery, flows between the deployment and Dermi services; the authoritative description of what Dermi processes is set out in the Dermi Privacy Policy.

This local-first approach means the practice maintains custody of its patient data. If internet connectivity is lost, Dermi Atlas Professional keeps working on the practice network. It checks its license over the internet at least every seven days; past that, records stay viewable and exportable but cannot be changed until it reconnects.

Encryption in Transit

Communication between client devices and the Dermi Atlas Professional server on the HTTPS address is encrypted using TLS. This includes the web application and real-time sync. Dermi Atlas Manager creates and maintains the certificate.

Audit Logging

Dermi Atlas Professional includes a configurable audit logging system that records access to patient data, authentication events, and administrative actions. Audit logs support compliance requirements by providing a verifiable record of system activity. Detailed configuration options are documented in the Audit Logging Configuration guide.

Compliance-Ready Architecture

The security architecture of Dermi Atlas Professional is designed to support compliance with major healthcare privacy regulations, including:

• HIPAA (United States)
• PIPEDA (Canada)
• Provincial privacy laws (such as Ontario PHIPA and Alberta HIA)

Detailed compliance guidance is available in the HIPAA Compliance Guide, PIPEDA Compliance Guide, and Data Security Architecture documentation. Each practice remains responsible for how it deploys and uses Dermi Atlas, including compliance with the privacy and health information laws that apply to it.

Software-Licensing Model

The Dermi commercial model is based on software licensing rather than the resale or secondary use of patient data. The handling of personal data, including any restrictions on secondary use, is governed by the Dermi Privacy Policy.