Security / HIPAA readiness
CareAxis Notes is designed to support HIPAA-conscious operations through safeguards, role controls, auditability, and vendor review. Production use with PHI requires proper BAAs, hosting configuration, agency policies, and a security risk assessment.
Tenant isolation
Agency data is scoped by agency ID.
Agency data is scoped by agency ID.
Role controls
Super admin, agency admin, DON reviewer, billing admin, support, and nurse roles.
Super admin, agency admin, DON reviewer, billing admin, support, and nurse roles.
Audit trail
Access logs, note events, PDF generation logs, and review actions.
Access logs, note events, PDF generation logs, and review actions.
Secure reports
Branded PDF reports can use expiring download tokens.
Branded PDF reports can use expiring download tokens.
Vendor readiness
AWS/OpenAI/Twilio usage requires appropriate compliance setup.
AWS/OpenAI/Twilio usage requires appropriate compliance setup.
Human review
Nurse attestation and DON exception review remain core controls.
Nurse attestation and DON exception review remain core controls.