Security by design for clinical workflows
eChart is designed for environments where access decisions, changes and clinical actions must be attributable. Security requirements are reviewed in the context of patient safety, privacy, tenant separation and operational continuity—not treated as a separate add-on.
Identity and access controls
- Role- and permission-based access, including read-only and full-access distinctions.
- Organisation and patient-context validation for protected records and actions.
- Session controls and support for strong authentication configurations.
- Server-side authorisation for clinical and administrative changes.
- Anti-forgery protection for state-changing browser requests.
Data protection and privacy
- Encrypted HTTPS transport for supported deployments.
- Customer-selectable managed cloud or customer-controlled local hosting.
- Input validation, parameterised data access and controlled document handling.
- Configurable access boundaries for organisations, staff and patient records.
- Processes for backup, recovery and retention are agreed and tested for the selected deployment model.
Auditability and accountability
eChart includes audit and activity records across patient access, clinical actions and administrative changes. Exact logging, retention and review procedures depend on configuration and the customer’s governance requirements. Audit records support investigation and accountability but do not replace active monitoring or workforce controls.
Deployment and data location
Managed-cloud and customer-controlled deployment models have different responsibility boundaries. During procurement we document hosting location, network controls, backups, recovery objectives, support access, subcontractors and data-handling arrangements applicable to the proposed environment.
Security operations
Secure operation includes patching, vulnerability management, privileged-access review, tested recovery, incident response and change control. Customers should align deployment controls with their risk profile and guidance such as the Australian Cyber Security Centre’s Essential Eight. Suspected vulnerabilities can be reported privately to support@echart.com.au; do not include patient data in the first message.
Compliance and assurance
eChart can support controls relevant to Australian privacy, health-record, safety and clinical-governance obligations, but software alone does not make an organisation compliant. Any certification, conformance, regulatory or security claim must be confirmed for the specific product version, deployment and written customer agreement. We can provide architecture, data-flow, control and due-diligence information during procurement under appropriate confidentiality arrangements.