How we protect your information
The portal holds facts about how your practice operates. It is designed so it never needs your patients' information, and it protects what you do store the way HIPAA expects you to protect yours.
No patient information, by design
Nothing in the binder asks about a patient. Every page reminds you not to enter patient names or health details, and our terms prohibit it. Incident and complaint logs are written in general terms ("misdirected fax, one patient, recalled").
Where your data lives
On CRU Technologies' own servers in central Minnesota, behind a dedicated firewall and intrusion detection, reached only over encrypted HTTPS. We do not use third-party cloud storage or analytics for portal data.
Encryption
- Every connection uses TLS (HTTPS), enforced with HSTS.
- Files you upload and every binder we generate are encrypted at rest (AES with an authenticated key).
- Passwords are stored only as salted scrypt hashes; we cannot see them.
Access control
- Each person has their own sign-in; the owner adds and removes team members.
- Optional two-step sign-in with an authenticator app.
- Sessions end after 30 minutes without activity and after 12 hours regardless.
- Five failed sign-ins lock the account for 15 minutes; repeated failures from one network are blocked.
- Every sign-in, save, upload, download and generation is recorded in an audit log, and you can see your own sign-in history.
We email your finished binder and status updates. Emails never contain patient information. Uploaded files are not attached to emails; they stay in the portal.
Backups and retention
Your binder and its prior editions are kept for at least six years, matching HIPAA's documentation retention rule, unless you ask us to delete them.
Business associate agreement
Because the portal is not designed to hold protected health information, most clients do not need a business associate agreement with us for it. If your IT services from CRU already include one, it covers this portal too. Ask us if you would like one.
Questions or a concern
Call 320-309-8645 or email [email protected]. Report a suspected security issue the same way and we will respond the same business day.