Security & privacy
The safest record is the one you never collect.
Most clinical software manages protected health information carefully. OmniFlowED takes a different route: the product has no place to put it. Everything below follows from that one decision.
What is and is not collected
Collected
- Location: the zone and room where the delay occurred.
- Two stage timestamps. These define the delay and its duration.
- Category and subtype: from controlled lists.
- Contributing factor, severity, recurring flag: the systemic cause.
- Optional ESI acuity level: a single triage category.
- Reporter identity: only when the reporter chooses to be named.
Never collected
- Patient name, MRN, date of birth or age.
- Chief complaint, diagnosis or clinical narrative.
- Any chart, order or result data from the EHR.
- Any per-clinician performance measure.
None of these fields exist in the data model. There is no setting that turns them on.
Controls
Live PHI guard on free text
The one optional note field is checked as it is typed. Patterns that look like an age, a date of birth or a record number are flagged to the reporter before the report can be filed.
Facility-scoped access
Accounts are scoped to a facility and enforced by row-level security at the database, not by the interface. A user cannot query beyond their own department's reports.
Encryption
TLS for everything in transit; encryption at rest on managed Postgres. No delay data is stored on the device beyond the current session.
Role separation
Two roles. Physicians see their own reports and the aggregate board; administrators see the aggregate and the review queue. Neither role has a view of an individual clinician's record.
Data portability
Full CSV export of your department's reports, on demand, at any time, including if you end a pilot.
Authentication
Email-verified accounts today, with SSO available for pilot sites that require it.
HIPAA
Where we stand, stated plainly.
- No PHI is collected or processed, so the data OmniFlowED holds is not a designated record set.
- A BAA is available for pilot sites whose compliance office requires one as a matter of policy.
- Delay reports are not part of the medical record, and they are not a safety event or peer review record.
Reviewing us?
Write to security@omniflowed.com and we will send the data model, the field-level inventory above in reviewable form, and answer a security questionnaire. We would rather answer it before a pilot than during one.
Send this to your reviewer.
Security and privacy questions get answered by a person, not a portal. Pilots are free and configured to your department's layout.