Named individual logins
One account per person, always. We will not use a shared login even if you offer one, because an audit trail that cannot name a person is not an audit trail.
Security, stated as refusals
A Business Associate Agreement is signed before anyone is given a login. Every person works under a named individual account in your own system. Nothing is exported, printed or copied out of it — that is a term of the agreement, and the floor controls that enforce it are listed below with which are still being put in place. Access ends the same day a person comes off your account, and when an engagement ends we confirm in writing that we hold nothing of yours.
Most security pages list what a vendor has. Certificates are cheap and a badge proves nothing. This page lists what we will refuse to do, because a refusal is the only part of a security posture that actually costs something to keep.
Nothing leaves your system
No exports, no printing, no copies to removable media or a personal inbox. It is a term of the agreement, and the floor controls that enforce it are shown to you before the BAA is signed.
BAA before access
A Business Associate Agreement is signed before anyone is given a login. Not after the first week. We will refuse access without it.
Access revoked same day
When somebody comes off your account their access ends that day, and we confirm it in writing.
No data retained
When an engagement ends we confirm in writing that we hold nothing of yours. There is no archive on our side.
Written every Friday
What was done, the numbers, and what went wrong. Including the weeks that went badly, because those are the ones worth reading.
What we commit to in writing
- Business Associate Agreement signed before first access
- A named individual login for each person, issued by you, never a shared account
- Access to your system limited to the people staffed on your account
- Nothing exported, printed or copied out of your system
- Access ended the same day a person comes off your account, confirmed to you in writing
- A named point of contact for any security question, not a ticket queue
Floor controls being put in place
We are early, and none of these is claimed as done until it can be shown. Ask for the evidence for any of them — a photograph, a signed form, a machine setting — during the BAA process; anything we cannot show you then is written out of the agreement, not into it.
- Personal phones kept off the working floor
- USB and removable storage disabled on production machines
- Printing disabled on production machines
- Personal email and file-sharing sites blocked on the work network
- CCTV over the working floor
- A signed confidentiality and HIPAA acknowledgement from every person, on file
- HIPAA training recorded before a person is staffed on a US healthcare account
The honest limit
No offshore vendor can promise you that a determined person cannot memorise a screen. Anyone who tells you otherwise is selling. What we can promise is that the account is named, the access is minimal, and every change is in writing, so that if something did go wrong you would be able to prove who, when and what. That is what an auditor asks for.
Questions
Do you sign a Business Associate Agreement?
Yes, and before anyone is given a login rather than after the first week. If a vendor is willing to start work before the BAA is signed, that tells you what their compliance is worth.
Are you HIPAA certified?
There is no such thing as HIPAA certification. No government body certifies anyone, and any vendor showing you a HIPAA certificate has bought a logo from a training company. What matters is the signed BAA, the technical and administrative safeguards, and whether the controls survive a bad week. Ours are listed on this page, including the ones still being put in place, and you are welcome to audit them.
Where is our data stored?
In your system, where it already is. We do not copy it, mirror it, warehouse it or process it through anything of ours, and nothing we run is built to hold patient data. Our internal tools refuse messages, file names and spreadsheets that carry patient identifiers, and every file shared internally is logged by person and time. A PDF or an image cannot be checked that way, so for those the rule is enforced by training and supervision rather than by software.
Is the work done outside the United States?
Yes. Every seat works from our office in Rawalpindi, Pakistan, logging into your systems remotely on your business hours. Some payer contracts and some state Medicaid programs restrict access to patient information from outside the United States, so check yours before you start. Our agreement lets either side exclude any work under such a restriction, and we will not knowingly work a queue that is covered by one.
What stops somebody taking a photograph of the screen?
The controls for it are phones kept off the desk, CCTV over the working floor and in-person supervision. They are being put in place now, and we will show you each one as evidence during the BAA process rather than ask you to take it on trust; any we cannot show you by then is written out of the agreement, not into it. This is a real risk and no vendor can honestly claim to have eliminated it, so we control it and we do not pretend otherwise.
What happens when a staff member leaves?
Their access to your system ends the same day and we confirm it to you in writing. You can also revoke it yourself at any moment, because the login is yours and was issued by you.
What happens when the engagement ends?
Access is revoked and we confirm in writing that we hold nothing of yours. Since nothing was ever copied out, there is nothing to destroy and nothing to certify the destruction of.
Anything not answered here, write to ops@softhomeglobal.com and it will be answered plainly, or read how an engagement actually starts.
Three ways to check us before you commit to anything.
Next step
One seat. One month. Cancel any time.
Twenty minutes on a call is enough to tell whether this fits. If it does not, I will say so.
Or write to ops@softhomeglobal.com