Security

Last Updated: September 29, 2026

How HomeCareBilling protects the records your agency keeps with us: what is encrypted, who can see what, what is logged and for how long, which services receive client information, and how to report a problem.

1. Encryption

1.1 In transit

• Every page and API request is served over TLS, and browsers are told to use HTTPS only (HSTS).
• Our servers connect to the database over TLS.
• Claim files are exchanged with Colorado HCPF over SFTP pinned to HCPF's host key; a connection to any other key is refused.
• Every call to an outside service is HTTPS, and webhooks you configure must be HTTPS.

1.2 At rest

Our hosting provider encrypts all stored data. On top of that, the application itself encrypts these fields with AES-256-GCM, with a key kept outside the code:

• a client's Social Security number and date of birth;
• a client's physical conditions, surgeries, other conditions, allergies, medications and instructions for field staff;
• the date of birth and diagnosis codes on each claim, and the narratives of critical incident reports (since September 29, 2026, when the earlier plain copies were removed);
• the contents of claim files sent to and received from HCPF (837, 835 and 999);
• uploaded claim spreadsheets;
• AI assistant conversations and AI-app call records;
• the previous values kept when a record is edited;
• credentials for connected services.

Other client information, including the AI-generated summary of a client's health conditions, is protected by the hosting provider's encryption of stored data, not by the application.

Passwords are stored as bcrypt hashes. API keys, one-time sign-in codes, two-factor recovery codes and invitations are stored only as hashes. When you sign in with Google, we keep your account identifier, not Google's access token.

2. Who can see what

• Each agency sees only its own records. Every query is scoped to the agency.
• Roles decide what each person can do within the agency.
• Two-factor sign-in with an authenticator app is available to every member. An agency admin can require it for everyone in the agency; members without it are then asked to set it up before anything else, and their connected apps stop working until they do.
• Sessions end after inactivity. Each agency chooses the timeout, from 5 to 60 minutes. Session cookies are encrypted, and marked Secure, HttpOnly and SameSite.
• Repeated failed sign-ins lock the account, and sign-in attempts are rate-limited.
• Our own access. When our support staff act inside an agency's account, the start and end of that access are logged, and the audit trail names who did what.
• Our database access. The running application connects with a database role that can add audit records but cannot change or remove them.

3. What is logged

• Every sign-in and failed sign-in, and the second factor used.
• Every view of a client record.
• Every change to a record, with its values before and after.
• Every request made by a connected AI app or through the API, and every AI-app action.

The audit trail is append-only: nothing in the application can change or delete it, and it survives the deletion of the account or agency it describes.

4. How long records are kept

The database is backed up daily, with hourly increments in between, and a restore from those backups was tested on September 29, 2026: the restored copy matched the live database.

5. Services that receive client information

Client street addresses are turned into map locations (for visit verification) on our own geocoding server, which runs alongside the service and sends them to no one.

6. Reporting a security issue

If you believe you have found a security problem, email hipaa@homecarebilling.co. Please include what you found and how to reproduce it. We will acknowledge your report and keep you informed as we fix it.

See also our Privacy Policy.