Novarra/Security
Ncrypt
The security module that comes with every Novarra application. It checks your session as you sign in, shows you each check as it is made, and says in plain words when one does not pass.
Built · in testingIncluded with every application. Not an add-on.
At sign-in
Four checks, and you watch each one.
Most software asks you to take its security on trust. Ncrypt makes four checks each time a session begins and draws its mark a quarter at a time as each one comes back. A check that could not be made is shown as not made. Nothing is ticked for show.
-
1. The connection is encrypted
Between your browser and us.
- The page and the server it talks to are both on an encrypted connection, and the server confirms how the request reached it
- The link between our server and the database is encrypted too, and is checked separately
-
2. It is really our server
Proved, not assumed.
- Your browser makes up a random challenge that nobody could have predicted
- The server signs it with a key only the real server holds, and your browser checks the signature itself
- An answer that is old, altered, or signed by anything else is refused
-
3. Your session is signed
Checked by the server, every request.
- The server confirms who you are and which practice you are working in
- The session is checked again every fifteen minutes while the application is open
-
4. Your practice's records are walled off
Tested in the database, as you.
- The database is asked, as your session, whether a client of another practice can be read
- The answer has to be no. That is the wall being tested, not described
- Where the database is not the one enforcing it, Ncrypt says so and does not show a tick
On screen
What you see.
- ✓Connection encryptedHTTPS, end to end
- ✓It is really our serverIt signed our challenge
- ✓Your session is signedEnds 5:30 PM
- ✓Your practice's records are walled offEnforced by the database
Signing in
The ring fills a quarter for each check that passes, then the panel closes by itself. This picture repeats to show the sequence; in the application it runs once, as fast as the checks themselves.
- ✓Connection encryptedHTTPS, end to end
- ✕It is really our serverThe server could not prove who it is
- –Your session is signedNot checked
- –Your practice's records are walled offNot checked
When a check fails
The mark turns red, the check that failed is named in plain words, and the panel stays until somebody has read it.
In the top bar, on every screen
The mark rests with a slow glow. Press it and the four checks are made again, in front of you. Sample data.
Everything else that protects a record
Built for PHI, from the database up.
Protecting a client's record is not a setting. It is how the product is put together.
- Isolation in the database
- Client records are fenced by row-level security in the database itself, so an organization's data stays its own whatever the application asks for.
- A signed BAA before day one
- You read and sign the Business Associate Agreement during setup, before any client information goes in.
- A trail for everything
- Who opened, changed and signed what, and when. Every reschedule and cancellation keeps its reason.
- Two-step sign-in
- Microsoft sign-in, an authenticator app, or a code by email. Your organization chooses what staff must use.
- Permissions by role
- Front desk, clinicians, billers and managers each get the access their job needs, and each department sees only its own work.
- No PHI in the logs
- Usage and error reporting is scrubbed of client information before it leaves the browser.
- Emergency access leaves a mark
- Opening a restricted chart in an emergency takes a stated reason, and the opening is recorded for review.
- Limits on every door
- Requests are counted, so guessing at passwords or flooding the service runs into a wall quickly.
- Encrypted on the way and at rest
- Every connection is encrypted, including our own link to the database, and what is stored is encrypted where it is kept.
Next for Ncrypt
What it will watch once you are in.
These are being built. They are listed so you know what is coming, and none of them is in the product yet.
- In development
Access, recorded where you can see it - The mark shows a chart opening being recorded, as it is recorded.
- In development
Something unusual, asked about - Many charts opened quickly, a new device, an odd hour: the mark turns amber and asks whether it is you, and the practice's owner sees it either way.
- In development
A security page for the owner - What was checked, what was blocked and what was flagged, as a timeline, with a weekly summary.
Ask us anything about how a record is kept.
Security questionnaires, the BAA, where data is held: write to us and a person answers.
Write to us