Security
EMRfi encrypts data in transit with TLS and at rest with AES-256-GCM. This page explains what that covers, for hospital IT and compliance teams.
Independent checks
Run against emrfi.com on November 3, 2026. Each link re-runs the test or opens the report, so you can verify it yourself.
- A+Qualys SSL Labs server test · re-run the test
- A+Security Headers (HSTS, CSP, frame, referrer, permissions policies) · re-run the test
- PassONC Inferno SMART App Launch STU 2.2 client suite (public client, EHR launch) · report (PDF)
No readable personal data
Every field that identifies a person is stored as AES-256-GCM ciphertext: patient contact details and references, provider references and descriptions, staff names and emails, invitations, signatures on agreements, and the audit trail. Sign-in and duplicate checks use keyed blind indexes (HMAC-SHA256), so an email address is never stored in the clear. The key is held only by the running application; the database, its backups, and a copy of the disk contain no readable personal data.
Data minimization
EMRfi holds an amount, your reference numbers, and an outcome. Card and bank data are entered on Stripe-hosted elements and never reach our servers. Payment plan applications happen on Affirm or Sunbit. We instruct every Provider, in the contract and in the API, not to send protected health information, and we do not need it to operate.
Money flow
Each Provider is its own Stripe account and the merchant of record. Patient payments are charged directly to that account; EMRfi's fee is collected by Stripe as an application fee. EMRfi never holds Provider funds and cannot move them.
Transport and storage
- TLS 1.2+ on every endpoint; HTTP redirects to HTTPS.
- Patient contact details and references are encrypted at rest with AES-256-GCM (unique IV and authentication tag per value); the key is held only on the application server.
- API keys stored as SHA-256 hashes; the plaintext is shown once and never stored.
- Nightly database backups are AES-256 encrypted before they are written.
- Webhooks to Providers are signed with HMAC-SHA256 and a timestamp.
- The database accepts connections only from the application server on the same host.
- Every Stripe event is recorded with its event ID to prevent replay.
Access
Provider staff access the portal with the organization's key; Stripe's embedded onboarding and payout views enforce Stripe's own authentication. Belmont Labs administrative access is limited to named staff over SSH keys.
Reporting a vulnerability
Email the request form with "Security" in the subject. We acknowledge within two business days.
Questionnaires
We complete hospital security questionnaires (HECVAT, SIG, or your own) on request as part of onboarding.