Security & compliance
Specific controls, not badges.
Cervica is built to comply with the HIPAA Security Rule. Here is exactly what that means in this product, stated plainly so you can hold us to it.
Encryption
All traffic is encrypted in transit with TLS. Data is encrypted at rest, and the most sensitive fields, such as Social Security numbers, carry an additional layer of AES-256 encryption on top of disk level encryption.
Patient-access audit logging
Cervica records audit events for patient access and sensitive actions, with user and time information. Authorized practice users can review available audit records in Settings. Ask us about coverage for the workflows your practice needs.
Role based access
Owners, providers, front desk, and billing staff each see what their role needs. Financial surfaces are permission gated separately.
Backups that have actually been restored
Cervica uses automated database backups. We have completed an isolated restore drill to verify recovery from a backup. Contact us for current backup and recovery information.
Your data is never used to train AI models
Cervica's AI features process your data to serve you and nothing else. Patient information is not used to train ours or anyone's models.
Business Associate Agreement
A Business Associate Agreement must be in place before a practice uses Cervica with protected health information. Arrange your practice’s agreements with Cervica EHR LLC. An evaluation practice does not sign a BAA. Our infrastructure uses AWS healthcare-eligible services under our AWS BAA.
Retention depends on the record
Clinical records, temporary intake recovery drafts and operational data have different retention needs. Patient deactivation is distinct from deletion, and temporary recovery drafts can expire. Review retention and return or deletion requirements in your practice’s agreements; this page does not promise permanent storage of every record.
Plan your records export
You can manage subscription cancellation from your billing page. Before cancellation takes effect, contact us to plan your records export and confirm available formats, scope, timing and access during transition. A chart-note export alone is not a complete practice export. Questions before you buy: support@cervicaehr.com.
A note on certifications: "HIPAA certified" does not exist as a real certification, and we will never claim badges we have not earned. When third party attestations are completed, they will be listed here with the reports to back them.