Your patients' data is safe. Here's exactly how.
Ad Vital is HIPAA compliant, signs a BAA with every practice, and operates controls aligned with SOC 2, NIST 800-53, and DEA 21 CFR Part 1311 for EPCS. No compliance theater — here's what we actually do.
Ad Vital is a HIPAA Business Associate. We execute a Business Associate Agreement with every customer practice and operate a written Security Risk Analysis and Risk Management Plan refreshed annually.
AES-256 at rest. TLS 1.2+ in transit, with HSTS enforced on all customer-facing endpoints. Database keys are rotated and managed in a FIPS 140-2 validated KMS.
SAML/OIDC SSO available. Mandatory MFA for prescribers. Role-based access control. Just-in-time access for support engineers, fully audited and customer-revocable.
Hosted in U.S.-region SOC 2 / ISO 27001 cloud regions. Tenant data is logically isolated. Daily encrypted backups with point-in-time recovery, tested quarterly.
Secure SDLC, mandatory code review, SAST and dependency scanning in CI, third-party penetration testing annually. Critical vulnerabilities patched within 7 days.
24/7 alerting on suspicious access patterns. Documented incident-response runbook with breach-notification timelines aligned to HIPAA and applicable state laws.
EPCS done by the regulation, not around it.
Electronic Prescribing of Controlled Substances on Ad Vital is implemented through DoseSpot in accordance with 21 CFR Part 1311. Every prescriber who transmits a controlled-substance prescription has been identity-proofed, has enrolled a second authentication factor (FIDO security key or a TOTP authenticator app), and digitally signs each prescription before transmission.
Audit logs for EPCS prescriptions are retained for the period required by federal and state law, are protected against modification, and are exportable to authorized regulators on request. The two-factor authentication requirement is enforced by the platform — it cannot be bypassed by administrators.
Every subprocessor is BAA-bound.
| Subprocessor | Purpose | Region |
|---|---|---|
| DoseSpot, Inc. | E-prescribing & Surescripts transmission | US |
| Plaud AI | Voice capture & transcription | US |
| Amazon Web Services | Hosting, storage, KMS | US |
| Documo / Etherfax | HIPAA-compliant fax gateway | US |
| Stripe, Inc. | Subscription billing (no ePHI) | US |
Customers receive 30 days' notice before any new ePHI subprocessor is added.