Security & Trust

Last updated: July 10, 2026

CareCommand handles some of the most sensitive information a care facility holds — residents' health records, medication administration, incidents, and funds. For that protected health information (PHI), CareCommand acts as a Business Associateunder HIPAA and processes PHI only under a signed Business Associate Agreement (BAA) and the facility's instructions. This page describes, in plain terms, how we protect it.

How we protect your data

Encryption

• All traffic is encrypted in transit with TLS, with HSTS enforced.
• Data is encrypted at rest by our cloud database provider, and we add application-layer AES-256-GCM encryption for the most sensitive stored credentials (e.g. bank-link tokens).

Access control & tenant isolation

• Role-based access control: staff see only what their role allows, with per-employee permission overrides.
• Every facility's data is isolated — a facility can only ever reach its own residents, records, and documents.
• Access to the platform requires authentication, and sensitive APIs are rate-limited.

Audit trail

• An append-only, immutable audit log records access to PHI — who, what, and when — as a HIPAA safeguard and for your own survey evidence.
• Application errors are captured through monitoring with PHI scrubbed from reports.

HIPAA & Business Associate Agreements

CareCommand operates as a HIPAA Business Associateand has implemented the administrative, physical, and technical safeguards described by the HIPAA Security Rule. (HIPAA has no government "certification" — any product that calls itself "HIPAA certified" is overstating. What actually matters is executed agreements and real, enforced safeguards, which we describe here and will document for your team or counsel on request.)

• We sign a BAA with every facility before any resident health information is entered.
• Every subprocessor that can touch PHI operates under an executed BAA — our application hosting, managed database and file storage, AI processing, and SMS/email providers. Our AI subprocessors are additionally contracted for zero data retention, so prompts that may contain PHI are not retained or used to train models.
• We do not send PHI to any third-party vendor that is not under a BAA. This is enforced in code: a PHI-bearing request to an uncovered vendor is blocked at the boundary rather than left to convention. Where a real-time channel cannot be covered by a BAA, PHI is not routed through it at all.
• We do not sell personal information or PHI, and we never use PHI for advertising.

Secure development & change management

• Every code change ships through pull request with required review and protected branches (change-control).
• Automated checks run on every change: secret scanning, static security analysis, and dependency review.
• We conduct security reviews of our own codebase and remediate findings on a risk-prioritized basis.

Infrastructure & resilience

• The platform runs on major U.S.-based cloud providers (application hosting and a managed PostgreSQL database).
• The database is backed up automatically by our provider, supporting point-in-time recovery.

Your data rights

• Facilities own their data. We honor data-subject and deletion requests through our data-request intake, and enforce retention rules automatically.

Our SOC 2 program

We are building toward a SOC 2 examination and want to be precise about where we are, because the word gets overused. We are not yet SOC 2 certified. What we have done:

• Documented our controls and written the underlying policies — access control, change management, data classification, incident response, disaster recovery, risk assessment, and a vendor/BAA register.
• Implemented the technical controls those policies describe (audit logging, RBAC + tenant isolation, encryption, retention enforcement, CI security scanning, change-control).

What remains before a report exists: engaging an independent auditor and running the observation period a SOC 2 Type II report requires. We're happy to share our control documentation and BAA with prospective facilities under NDA in the meantime.

Reporting a vulnerability

If you believe you've found a security issue, please email security@carecommand.online. We take reports seriously and will respond promptly. Please give us a reasonable chance to remediate before any public disclosure.

Questions from your team or your attorney? Our BAA and security policy documentation are available to prospective and current facilities on request. See also our Privacy Policy and Terms.