HIPAA Compliance

ReachDR treats every piece of clinical and health information passing through our platform as sensitive by default. Our administrative, technical and physical safeguards are designed to protect the confidentiality, integrity and availability of protected health information (PHI).

PHI handled on our platform includes consultation notes, medication charts, pathology and investigation results, wound and assessment records, and any other clinical documentation created or reviewed during a telehealth encounter.

• Role-based access so staff only see information required for their role.
• Mandatory confidentiality and privacy training for all personnel.
• A designated Compliance Officer responsible for privacy and security oversight.
• Documented incident response and breach-notification procedures.

• Encryption of PHI in transit and at rest.
• Unique authenticated logins for every clinician, facility and staff account.
• Audit logging of access to clinical records.
• Automatic session timeouts on inactive devices.

Infrastructure hosting PHI runs in access-controlled data centres operated by reputable cloud providers, with physical and environmental controls consistent with recognised security standards.

Where third-party providers (such as hosting or pathology integration partners) process PHI on our behalf, we put appropriate agreements in place requiring them to protect that information to a comparable standard.

Residents and their authorised representatives may request access to, or correction of, their clinical records held by ReachDR, subject to applicable health-records law and the facility’s own record-keeping obligations.

In the event of a data breach involving PHI, we will investigate promptly and notify affected individuals and relevant authorities in accordance with applicable law and timeframes.

For compliance questions or to report a concern, contact support@reachdr.com.