Privacy and security
Safety of your data — whether you are a health care receiver, provider or researcher — is the Foundation's stated first priority. This page says what that means operationally.
Each independently auditable
Three, from the Foundation's own statement
Safety of your data is the top priority
For health care receivers, providers and researchers alike.
Stringent data privacy policies with end-to-end encryption
In transit and at rest.
Multi-tenant architecture with portability
Providers and researchers can port their data from CAD CARE applications to their own choice of FHIR-enabled application, on demand.
What happens if it goes wrong
Detection
Audit-log monitoring, anomaly alerting and support intake.
Assessment and containment
Scope established and the exposure closed.
Notification
To the Data Protection Board and to affected individuals within the statutory period; where we act as processor, immediately to the clinic that is the fiduciary.
Review
Post-incident review, with remediation tracked to closure.
Named
Independent security assessment
Not yet commissioned. It is a gate before real patient data, and it is on the published compliance register with everything else outstanding.
Read the full register.
Including the items still open.