Built for records you are trusted with.
Medical records are some of the most sensitive documents there are. This page says plainly how Case Nurse handles them, what we have in place today, and what is still on the way.
Built in Atlanta. Your records stay in the U.S. Stored on AWS in Ohio, processed in U.S. regions, and never used to train AI models.
Where your records live
- Case Nurse runs on Amazon Web Services. Records are stored in the US East (Ohio) region, and Case Nurse has signed a Business Associate Addendum with AWS.
- Text recognition and AI-assisted processing use Amazon Textract and Amazon Bedrock inside AWS, in US regions.
- No service outside AWS receives your records.
How records are protected
- Encryption. TLS 1.2 or higher in transit. AES-256 at rest. Storage refuses unencrypted connections.
- Sign-in. Multi-factor authentication is required for every account, with an authenticator app or an emailed code. Idle sessions sign out after 30 minutes. Accounts are created by Case Nurse, not open sign-up.
- Isolation. Every request is checked against the account’s own practice. One customer cannot reach another customer’s records.
- Staff lockout. Case Nurse administrator and developer credentials are denied access to customer records by policy. The only way in for a person is a separate emergency role that requires multi-factor sign-in, expires after one hour, and is logged.
- Downloads. Download links expire after one hour. We never send records by email.
- No patient data in logs. Application logs and product analytics are built to exclude record contents, names, and file names.
Audit trail and backups
- Reads and writes on record storage and the database are logged by AWS CloudTrail and kept for seven years in storage that cannot be deleted.
- Every download link issued is logged, and edits to a chronology are recorded with who made them and when.
- The database supports point-in-time recovery for 35 days, with daily backups kept 35 days and monthly backups kept one year. Stored files are versioned.
How we use your data
- We use your records to provide the service to you, as set out in our Data Processing Agreement.
- We do not train AI models on your records, and AWS does not use them to train its models either.
- We do not delete records on a timer. When you ask us to delete them, we do, subject to the backup terms in our Data Processing Agreement.
Contracts and insurance
- Business Associate Agreements. Hospitals and physician groups: a BAA is signed before any patient records are shared in a pilot. Legal nurse consultants: records you receive in discovery are handled under our Terms and Data Processing Agreement; if your work involves records straight from a hospital or provider, talk to us before you upload.
- Data Processing Agreement. Every customer account accepts our DPA, which covers confidentiality, sub-processors, breach notice within 72 hours, deletion, and audits.
- Insurance. Case Nurse carries technology errors and omissions and cyber liability insurance.
Where we are on certifications
Case Nurse does not yet have a SOC 2 report. Our controls are mapped to SOC 2 and the HIPAA Security Rule, and a SOC 2 audit is planned. In the meantime we answer security questionnaires and share our security documentation on request.
Questions or a concern
For a security questionnaire, documentation, or to report a vulnerability, email security@casenurse.com. For privacy questions, email privacy@casenurse.com.
This page describes our current practices and is not a contract. Your agreement with Case Nurse, including the Data Processing Agreement and any Business Associate Agreement, governs.