Security
Designed around patient data.
Vitae is built for practices that handle protected health information every day. Here is how we protect it.
AI processing
- AI models run on AWS under a Business Associate Agreement with Amazon.
- AWS states that data processed by Amazon Bedrock is not used to train its models.
- Every AI-drafted note is reviewed and signed by the clinician.
Signing in
- Staff sign in with passkeys, with an authenticator-app code as backup. There are no text-message-only accounts.
- Staff sessions lock after 15 minutes idle and end after 12 hours.
- Signing notes, exporting records, changing user roles, and opening records outside your own patients each ask for a fresh passkey.
- Patients sign in with one-time email codes and join by invitation only.
Access and data
- Role-based permissions, so each user sees only what their role needs.
- Logged access, so the practice knows who opened what.
- Encryption in transit and at rest.
- Each practice’s records are kept separate from every other practice’s.
Records and infrastructure
- Every sign-in event is written to a permanent log, kept for at least six years.
- Clinical records keep their history. Changes are versioned, not erased.
- Vitae runs on Amazon Web Services in the United States.
- A Business Associate Agreement with every practice, and with the vendors that handle patient data.
Reporting a security concern
Tell us what you found.
To report a security concern or a suspected vulnerability, email security@vitaeehr.com.
Built by practicing clinicians, for the practices they know.
See how Vitae fits your practice in a short demo, or start a 14-day trial.