Security

Sefton is operated by Sefton Health, Inc. and is built to support HIPAA compliance. For PHI, Sefton Health, Inc. acts as a Business Associate of the healthcare provider (the Covered Entity) and signs a Business Associate Agreement (BAA) with covered customers. We process Protected Health Information (PHI) only to provide and support the Service.

• Encryption in transit and at rest for PHI.
• Role-based access control with least-privilege access.
• Multi-factor and passkey/WebAuthn authentication options.
• Tenant isolation between customer practices.
• PHI-aware audit logging of access to records.
• Secrets management, security headers, and origin controls.

The Service is hosted on Amazon Web Services (AWS) in a HIPAA-eligible configuration under a signed Business Associate Agreement. Data is processed in the United States.

PHI-bearing sub-processors operate under signed Business Associate Agreements (currently AWS and Optum). Payment (Stripe), push-notification, identity, and source-control vendors are kept out of PHI scope.

For BAA or HIPAA-compliance inquiries, contact compliance@sefton.health.

We maintain incident-response and breach-notification procedures consistent with HIPAA. In the event of a breach of unsecured PHI, we notify affected providers without unreasonable delay so they can meet their own notification obligations as the Covered Entity.

As the Covered Entity, your practice is responsible for protecting account credentials, managing user access, configuring security options such as multi-factor authentication, and obtaining the patient consents required for your use of the Service.