Security
ACCESS
Read-only EHR access
Rette reads operative and clinical notes from athenahealth or eClinicalWorks. It never writes to your chart.
ENCRYPTION
Encrypted in transit and at rest
Rette encrypts all data in transit and at rest and uses AES-256 encryption.
ACCOUNTS
Role-based access and MFA
Access follows role-based, least-privilege controls, and sign-in is protected with multi-factor authentication.
HOSTING
Hosted on Google Cloud
The Rette platform runs on Google Cloud Platform (GCP).
AGREEMENTS
Business associate agreements
Rette makes BAAs available, and patient data is shared with Rette only under a BAA.
AUDIT
SOC 2 Type I
Rette has completed a SOC 2 Type I audit, an independent assessment of how its security controls are designed.
Security questions
Is Rette HIPAA compliant?
Yes. Rette is HIPAA compliant and makes business associate agreements (BAAs) available. Patient data is shared with Rette only under a BAA.
Has Rette completed a SOC 2 audit?
Yes. Rette has completed a SOC 2 Type I audit. A Type I report covers whether security controls are suitably designed at a point in time.
Does Rette write anything to our EHR?
No. Rette’s access to your EHR is read-only. It reads operative and clinical notes to flag documentation gaps and suggest codes for your coders, and it never writes to your chart.
Where is Rette hosted?
The Rette platform is hosted on Google Cloud Platform (GCP). Rette encrypts all data in transit and at rest, access follows role-based, least-privilege controls, and sign-in uses multi-factor authentication.
Who do we contact with security questions?
Email info@rette.ai, or ask us on a demo call.