Security is the product.
Healthcare data is the most sensitive data there is. These are the controls built into EziiDesk today, designed to support HIPAA and India's DPDP Act requirements. We have not yet completed a formal compliance assessment, and we say so plainly.
Six pillars
Record-access logging
Opening patient records is written to a tamper-evident audit log: who opened what, and when.
Strong sign-in
Sign-in supports multi-factor authentication and passkeys, and unusual sign-ins get extra checks.
Protected sessions
Signed-in sessions are protected against takeover.
Each hospital kept apart
Each hospital's data is kept apart from every other hospital's. Nothing is shared between hospitals.
Break-glass with review
A doctor can open a chart outside their care in an emergency, but must give a reason. Medical records staff review every break-glass access.
Self-hosted AI
EziiAssist runs on an open medical model on infrastructure Virceton Technologies operates or the hospital hosts. Patient data is not sent to third-party AI services. Every AI call is audited, and AI is switched on per hospital.
What patients see in EziiCloud
EziiCloud is the patient portal that pairs with EziiDesk.
Versioned consent
Each consent a patient gives, at sign-up and before a video visit, is pinned to the exact policy version in force at the time.
Ask for my records
Patients can raise a request for their records and follow its status. The hospital's medical records team answers it in EziiDesk, and every release is logged.
Close my account
Patients can close their portal account from Account Settings. The hospital keeps the medical record, as the law requires.
Download my record (FHIR)
Patients can download their health record as a FHIR R4 file.
What hospital IT sees
Money audit
Every refund, discount and bill settlement must carry a named person, so money movements can be traced.
Incident tracing
Incidents can be traced end to end in our logs.
Application firewall
Malicious requests and scanners are screened out before they reach the application.
Abuse protection
Sign-in and forms are protected against password guessing and automated abuse.
Security headers and encryption in transit
A strict content security policy, HSTS, X-Frame-Options and Referrer-Policy on every response. All traffic uses TLS 1.2 or later.
Self-hosted assets
Every script, stylesheet and font is served from your hospital's own address. No page loads code from a public CDN.
Need our security answers?
Send us your security questionnaire and we'll answer it, with a walk-through of these controls in the live demo.