Patient data, handled the way HIPAA expects.
Revora is designed for covered entities and business associates: least-privilege access, a complete audit trail, and patient-facing links that reveal nothing on their own.
What is in place.
Technical safeguards built into the product; administrative and physical safeguards come with your deployment and our business associate agreement.
Role-based access
Front desk, doctors, billing and payer users each see only their portal. Payer users see only their own organization's data.
Audit log
Every sign-in, every patient, claim and document viewed, and every change is logged with who, when and what.
Signed sessions
Passwords are stored as salted PBKDF2 hashes; sessions are signed tokens in HTTP-only cookies that expire.
Patient links
Check-in and statements use unguessable single-purpose links; they show first names and the last four digits only.
Encryption
TLS for every connection in production; deploy the database on encrypted storage. Card payments go to your processor, never through Revora.
Minimum necessary
Logs never contain request bodies or note text; error messages never echo submitted values.
Business associate agreement
We sign a BAA with every customer before any protected health information is loaded. The sample practice in the live demo contains only fictional people.
Data retention
X12 interchanges, eligibility responses and remittances are kept verbatim for audit and payer disputes for as long as your retention policy requires, then removed.
Reporting a concern
Email security@revora.health. We acknowledge reports within one business day.