Security & HIPAA
Built for HIPAA — and honest about where we are.
Ovelit Care is designed around the HIPAA Security Rule's safeguards. Software alone doesn't make a practice compliant: the hosting, every vendor that touches PHI and your own policies matter too.
This public site is a demo
patientportal.ovelithub.com runs in demo mode on shared hosting that is not covered by a Business Associate Agreement. Every patient here is synthetic and the data is wiped nightly. Do not enter real patient information. Production practices run on a separate BAA-covered environment.
What's built into the product
Audit log of PHI access
Every chart view, export, print and signature is recorded with user, time, IP and device.
Role-based access control
Owner, admin, provider, nurse/MA, front desk and billing roles; staff only see the practices they belong to.
Multi-factor authentication
App-based MFA (TOTP) with recovery codes for staff accounts.
Encryption
TLS in transit; MFA secrets encrypted at the application layer; database and backup encryption at rest on production hosting.
Tenant isolation
Each practice is a separate tenant; every query is scoped to the practice or, in the portal, to the patient.
Patient-controlled communication
Email and SMS opt-outs are honoured automatically and every message is logged.
Required before any real patient data
These are on our production-hardening plan and must be in place before a practice goes live:
- BAA-covered cloud hosting with managed, encrypted database, backups and point-in-time recovery
- BAAs with every vendor that touches PHI: email, SMS, video, AI and file storage
- A HIPAA-eligible video vendor in place of the public video service used in the demo
- AI features only through a BAA / zero-retention agreement
- Independent security review and penetration test
- Session timeouts and enforced MFA for clinical roles
- Field-level encryption for sensitive identifiers
- Counsel review of terms, privacy policy, Notice of Privacy Practices and BAA template
Found a security issue? Email security@ovelithub.com. Please don't test against other users' data.
Explore safely in the demo.
Synthetic patients, real workflows — reset every night.