How we handle patient data

Protected health information

Everyboard does not accept protected health information without a signed business associate agreement. Until a practice has signed one, anything submitted to Everyboard must be de-identified.

Our clinical evaluation uses synthetic patients only.

Business associate agreements

We sign a business associate agreement with a practice before it shares protected health information with us. Processing of that information will run only on infrastructure covered by business associate agreements with our cloud providers.

The software enforces the provider side. In production, reading records and running a board both require a model provider covered by a business associate agreement, and a provider that is not on that list stops the work instead of being tried.

Accounts and access

There is no public sign-up. Everyboard creates each account for a named person at a practice, and sign-in runs on Amazon Cognito in a United States region.

Where the work runs

Board runs execute on our own workers on Amazon Web Services. Before the first practice shares protected health information, our database and the language models behind each run move onto providers covered by business associate agreements.

What we have not done yet

Everyboard has not completed a SOC 2 audit. We will begin one when practices need it, and this page will say so when it is under way.

Security program

Our security program is run by our chief technology officer, a CISSP who has led FedRAMP, SOC 2 Type II and ISO 27001 programs. Practices evaluating Everyboard can ask us for our security documentation.