“Is our data safe?” is the first question most directors ask us. Here is exactly how Kordera protects it, in plain English. If your IT person wants the technical details, they are further down the page.
Records are scrambled while they travel and while they sit on the server. The most sensitive details get a second lock on top.
Each staff member sees what their role needs, and nothing more. Sensitive numbers stay hidden even from people who can open the chart.
Every time someone opens or changes a record, Kordera writes down who, what, and when. Nobody can quietly edit that history - not your staff, and not us.
Passwords alone are not enough for health records. Kordera adds a second step and blocks the weak spots attackers look for.
A chart left open on a desk is a real risk. Kordera locks the screen after 20 minutes without activity and hides the record behind it.
If something goes wrong, your records come back. Backups are encrypted before they ever leave the server.
Every agency gets its own installation and its own database. And we sign a Business Associate Agreement with you before go-live, so the HIPAA paperwork is handled from day one.
The same safeguards, in the terms they will ask about.
| HIPAA | Built to Security Rule safeguards; Business Associate Agreement signed before go-live |
| Tenancy | Dedicated installation and database per agency |
| In transit | TLS on every connection, HSTS enforced, secure cookies |
| At rest | Encrypted disk volume for the database and stored files; AES-256 field-level encryption for SSN, Medicaid, insurance, court case numbers, and signatures; document storage encrypted |
| Authentication | TOTP authenticator or WebAuthn passkeys; MFA enforceable for all users or privileged roles; 12+ character passwords screened against breach corpora; sign-in rate limiting |
| Authorization | Role-based, capability-level permissions; masked identifiers with password re-entry to reveal, logged |
| Sessions | 20-minute idle lock across tabs (shorter on shared devices), records hidden behind the lock |
| Audit trail | Every PHI view and change logged; append-only enforced by database triggers; hash-verified nightly |
| Logging | Sensitive fields scrubbed from application error logs |
| Backups | Hourly, encrypted before leaving the server, stored off-server; retained up to six months; restore-tested |
| AI (KORA) | Speech-to-text runs on the device, audio never leaves it; transcript text only to Google Vertex AI under a Google Cloud BAA; staff review every note |
Yes. Kordera is built to the HIPAA Security Rule's safeguards, every look at a record is logged, and we sign a Business Associate Agreement with your agency before go-live.
No. Every agency gets its own installation and its own database. Your residents' records are never stored alongside another agency's.
Records live on the server, not on the device, and the screen locks itself when it sits idle. Turn off that person's account and their access is gone immediately. Every record they opened is in the audit log.
Yes. You can require it for all staff, or only for admins and the people who handle billing and sensitive fields. Staff can use an authenticator app or a passkey.
When KORA helps with a note, the audio stays on the staff member's device and is turned into text there. Only that text is sent to Google's AI service, which is covered by a Business Associate Agreement. Nothing is auto-signed - staff review every note.
Yes. Send it over and we will answer it, and we are happy to get on a call with your IT person.
Send us your security questionnaire, or bring your IT person to a demo. We will walk through all of it.
Not ready for a call? Send us what you pay today and we'll show you what you'd save →
