How we work with protected health information
Testing does not require production patient data. Environments run on synthetic records and de-identified extracts, which removes most of the exposure before the first test case is written. What remains is contractual and operational: the agreement that has to be signed, where the people and the data sit, and who can reach a test environment.
What does a buyer ask before handing over an environment?
- Do you sign a Business Associate Agreement?
- Yes. The contracting entity is settled during the engagement, not here.
- Where are the engineers who would work on this?
- Wherever your own rules require them to be. Where a buyer sits decides which working locations are acceptable to them, so the location of the team is part of the engagement terms and is agreed before the contract rather than after it. Ask for it in writing at the point you ask for the BAA.
- Where does project data physically live?
- In your systems. Project data stays with you, and the work is done against environments you control rather than against a copy held here.
- Do you ever work with production patient data?
- No. Testing runs on de-identified data, not on production patient records. Where a test genuinely needs a real-world shape, the route to it is agreed in writing before an environment exists, and de-identification is verified rather than assumed.
- What happens to our data when the engagement ends?
- It never left you, so there is nothing here to return or destroy. What ends is access, and the access list is yours to close.
What does this website do with your visit?
- Does this site track you?
- No analytics, no tracking pixels, no chat widget and no third party scripts of any kind. Nothing on these pages loads from another company, so no other company learns that you read about audit findings today. The check that enforces this runs on every build.
- Where do the fonts come from?
- From this domain. The typefaces are downloaded at build time and served from the same origin as the pages, so opening a page sends no request to a font host and sets no cookie on its behalf.
- What happens to what you type into the contact form?
- It goes to one receiver, named in the repository, and nowhere else. There is no analytics call attached to the submit, and no copy of the message is kept in the browser. Do not put patient data in it: the form is a way to start a conversation, not a channel for PHI.
What does validating your product actually involve?
Answer four questions about your markets, your product type and its integrations. You get the standards that reach you, the artefacts each one asks you to produce, and which of them a test supplier delivers.