Security, compliance, and privacy is the number one priority at Cass. Naturally, we are HIPAA-compliant, and have engineered our architecture to handle sensitive information from the ground up. We ensure that you are kept completely safe, secure, and invisible to others.
Security is an evolution, and not just something that is installed. We constantly update our threat profiles, patch our software, and regularly penetration-test our servers. Our philosophy is to assume a breach; thus we implement an aggressive defense-in-depth security strategy that includes everything from effective password hashing to complex countermeasures. It is important to remember that compliance does not imply security; good security is always compliant.
We secure all data in transit via TLS, and use the latest technology to ensure data security. The independent SSL audit authority Qualys has rated our servers A+, and our HTTP (security) headers have been rated A.
SECURITY PROTOCOL
Below you will find details of our security protocol and adopted standards that have been cleared for public release for the sake of transparency.
X.509 / TLS (SSL IS OLD TLS)
We secure all data in transit via TLS, and use the latest technology to ensure data security.
SERVER ACCESS
The independent SSL audit authority Qualys has rated our servers A+
ADMINISTRATION / CUSTOMIZATION PLATFORM ACCESS
All systems log the date and time for all failed user attempts and for all successful user attempts to access the system.
PHYSICAL SECURITY ELEMENTS
Our offices have a security guard at the entrance and require badge access or visitor registration upon entry. Our computers are password protected and can be wiped remotely if needed.
DATA DELETION
All PHI that is no longer required for the intended and agreed upon scope is deleted immediately and securely. For secure printed data deletion, we enforce the use of a Security Level P-5 shredder, although documents with a high sensitivity are incinerated.
FAQ
Below are the answers to common concerns we've heard from patients, psychologists, and lawyers.
ARE YOU HIPAA-COMPLIANT?
Yes, so long as you are on Cass's network. This includes cass.ai but does not cover any communication through third-party channels, such as SMS, Facebook Messenger, and WhatsApp (Signal by Open Whisper Systems is the only exception to this rule). Our servers that handle patient health information are dedicated. For more information, please refer to part 160, part 162, and part 164 of the United States Code of Federal Regulations.
DO YOU COMPLY WITH DATA PROTECTION REGULATIONS?
Yes, we are HIPAA-compliant, and have engineered our architecture to handle sensitive information from the ground up, meaning that we vastly-exceed regulatory specifications in most areas. We encrypt all data with at least 256-bit asymmetric or 4096-bit symmetric keys.
DOES THIS SERVICE COMPLY WITH ESTABLISHED STANDARDS?
Yes, we are HIPAA-compliant, and have engineered our architecture to handle sensitive information from the ground up, meaning that we vastly-exceed regulatory specifications in most areas.
CAN YOU INTEGRATE WITH OUR EHR or HR CRM?
Yes
ARE MY CONVERSATIONS ANONYMOUS?
This is possible if you refrain from saying your name, and you’re using Cass on the web. Other communication protocols require information such as a phone number or a Facebook profile.
HOW CAN I TELL IF I AM LEAKING INFORMATION ?
Use our Brief Exposure Check, safe in the knowledge that your data will not be collected. Be careful with websites offering similar checks, many harvest your information. Remember, this data is a best guess, and can vary from browser to browser.