Security & Privacy Practices

1. Authentication

Krasyn EMR uses Firebase Authentication for identity management. All users must authenticate with email and password before accessing any part of the system. Production environments enforce strict session policies with no bypass mechanisms.

• Password policy: minimum 8 characters, requires uppercase, digit, and special character
• Account lockout after 5 failed login attempts (15-minute lockout)
• Session timeout after 20 minutes of inactivity
• Secure, HttpOnly session cookies with SameSite=Strict

2. Authorization

Krasyn EMR implements role-based access control (RBAC) with four distinct roles, each with specific scope-based permissions:

• Administrator: Full system access including user management, organization settings, and audit log review
• Physician: Patient records, clinical notes, orders, prescriptions, and lab/imaging results
• Nurse: Patient records (read), medication administration, vital signs, and document management
• Administrative Staff: Patient records (read) and document management

3. Tenant Isolation

Multi-tenant data isolation is enforced at multiple layers to ensure organizations can never access another organization's data:

• Service layer: Every database query includes mandatory organization ID filtering via TenantGuard
• Database rules: Firestore security rules enforce organization ownership on every document
• Defensive assertions: Missing organization context triggers an immediate access denial
• Automated testing: Cross-tenant access attack tests run in every CI build

4. Encryption

• In transit: All connections use TLS 1.2+. HSTS is enforced in production with a 1-year max-age.
• At rest: Google Cloud Firestore encrypts all data at rest using AES-256. Backups use Customer-Managed Encryption Keys (CMEK).

5. Audit Logging

Krasyn EMR maintains a comprehensive, immutable audit trail covering:

• All patient chart access (read events)
• Clinical note creation, editing, signing, and locking
• Order creation and status changes
• Administrative actions (user invitations, role changes, organization settings)
• Authentication events (login, logout, failed attempts)

Audit logs record timestamps, user identity, organization context, patient context (where applicable), action type, resource identifiers, and request metadata. Audit records are append-only and cannot be modified or deleted.

6. Infrastructure Security

• Application hosting: Microsoft Azure App Service with managed identity
• Secret management: Azure Key Vault for all credentials and API keys
• Monitoring: Azure Application Insights for real-time telemetry and alerting
• CI/CD security: Automated secrets scanning (gitleaks), dependency auditing, and governance gates on every pull request

7. Backup & Recovery

• Daily automated Firestore exports to Google Cloud Storage
• 30-day retention for daily backups, 90-day for weekly backups
• Quarterly restore rehearsal drills
• Backup verification via Cloud Functions with alerting on failure

8. Vulnerability Reporting

If you discover a security vulnerability in Krasyn EMR, please report it responsibly:

• Email: security@krasyn.com
• Subject line: "Security Vulnerability Report"
• Include steps to reproduce and potential impact

We commit to acknowledging reports within 48 hours and providing updates on remediation progress.