Where your patients’ records are stored, and five questions to ask any clinic software vendor
Cloud software means someone else holds your records. This guide explains what to ask, why overseas services are normal and need disclosing, and how Praxia answers.
Why the question is harder than it looks
“Stored in Australia” sounds like a complete answer. It rarely is. A practice system is several services: an application, a database, backups, messaging, monitoring, perhaps video. Each can sit in a different country. A vendor that says all patient data is stored in Australia either runs very simply or is describing only one part. The honest answer is a list. The list matters because it changes what you tell patients. If your own privacy policy says records stay in Australia and one of the services your software uses holds contact details overseas, the policy is out of step with how the system works, whatever the vendor’s brochure says. Asking for the list is how you keep your own documents accurate.
Five questions to ask any vendor
- 1. Where is the clinical records database, and its backups? Ask for the region, not just the country.
- 2. Which other services touch patient information, and where are they? Ask for the full list, including messaging, monitoring, video and AI.
- 3. How is each clinic’s data separated from every other clinic’s? Ask what technically prevents one clinic seeing another’s records.
- 4. Who can see what inside your clinic? Ask whether access is by role and whether key actions are logged.
- 5. What happens when you leave? Ask about export and deletion, in writing.
How Praxia answers
Each clinic’s data is kept isolated from every other clinic’s.
Some services we rely on are overseas, including our CRM and booking platform, video consults and error monitoring, and we disclose each in our privacy policy under Australian Privacy Principle 8. Some patient contact and appointment details are held by our CRM provider, which is overseas and disclosed in our privacy policy. Ask any vendor, ourselves included, to put the same plain statement in writing.
Each clinic’s data is separated from every other clinic’s at the database level. Access is role based. Data is encrypted in transit and at rest. We keep an audit trail of key actions. There are daily automated backups, including an encrypted off-host copy. Staff sign-ins and patient links expire automatically.
What Praxia does not claim
- We do not hold ISO 27001, SOC 2, IRAP or Essential Eight certification, and we do not say we are compliant with any of them.
- We have not had an independent penetration test.
- We do not say we are compliant with the Privacy Act; we say Praxia is designed with the Australian Privacy Principles in mind, and our privacy policy describes how we handle information.
- We do not claim consult audio is processed in Australia for the scribe, because that decision is not finished.
A vendor who lists what it does not have is easier to trust than one who lists only what it does.
Why overseas is not automatically bad
Overseas services are normal in modern software. What matters is that they are disclosed, that the agreements covering them are in place, and that sensitive content is kept out of the places it does not need to go. Under APP 8, a clinic or vendor that discloses personal information overseas must take reasonable steps to ensure the recipient handles it appropriately, and should tell patients. Read the sub-processor list of any vendor, not only the headline.
What to do with this
Put the five questions in an email to every vendor you are considering, Praxia included, and keep the answers. Tell your patients, in your own privacy policy, which services you use. Our privacy policy lists the services Praxia uses and where each sits, and our FAQ answers the most common data questions.
Questions clinics ask
Is it a problem if a vendor uses overseas services?
Not by itself. What matters is that the vendor discloses each service, that appropriate agreements are in place, and that you can see the full list. Be cautious of a vendor who will not give you one.
Do patients need to be told?
Your own privacy policy should describe the services you use that handle patient information. Ask your adviser what is required for your clinic, and keep the vendor’s disclosure list on file.
Does Praxia have security certifications?
No. We do not hold ISO 27001, SOC 2, IRAP or Essential Eight certification, and we have not had an independent penetration test. We describe what we have built, and leave the verdict to you.
Where Praxia fits, and where this guide stops
Praxia is a pilot with Evolution Medical Care, a clinic run by Praxia’s founders, and is being onboarded to it now. We wrote this guide from how clinics work and from what Praxia is built to do. It is general information, not legal, clinical or financial advice, and nothing here promises a result for your clinic.
If you would like to see how this works in Praxia, request a walkthrough.
Related guides
Talk to us about your clinic
If you want to put these five questions to Praxia, a walkthrough is the place to do it, and we will answer in writing. If it is not the right time, join early access and we will be in touch.