Security
How we protect it.
Only the controls that are live today. If it’s on this page, it’s running. Found something that looks wrong? Write to aloha@cultureohana.com.
No patient data
Patient information doesn’t go into CultureAI, and won’t until every company involved has signed the business associate agreement that federal privacy law requires.
A HIPAA-ready database
Our database runs with its provider’s HIPAA safeguards turned on.
Questions aren’t kept
What visitors ask a question box isn’t saved, and neither is who asked.
Two-step sign-in
Our people can add a second step to sign in, and owners can require it for leaders.
Sessions that end
A session ends after a set time without use, and anyone can sign out everywhere else at once.
An activity log
Sign-ins, changes and agent decisions are written down, in plain words, for owners to read or download.
Access keys stay secret
A key is shown once, when it’s made. We keep only a fingerprint of it, and a key can be rolled or revoked at any time.
Practice stays separate
Test keys reach a sandbox only, never our companies’ real records.
Every request can be traced
Each request carries its own tracking number, so any problem can be followed to its source.
A person approves
An agent drafts the next step. Nothing changes until a person approves it.
Encrypted in transit
Every page and every request travels over HTTPS.