Security at DocLinQ

Last Updated: Jul 3, 2026

DocLinQ takes security and privacy seriously. Our security program is built to protect electronic protected health information (ePHI) and all customer data across every layer of our platform — from the way we write code to how we respond to incidents.

DocLinQ is HIPAA compliant and has completed an independent SOC 2 audit. Security documentation, Business Associate Agreements, and additional compliance evidence may be available to authorized customers upon request and under appropriate confidentiality terms.

1. Role-Based Access Control

Access to DocLinQ systems and data is governed by the principle of least privilege. We implement role-based access control (RBAC) across the platform to ensure that users — both internally and externally — can only access the data and functions necessary for their role.

• Practice staff, providers, and administrators each have distinct permission sets.
• Multi-factor authentication (MFA) is enforced for privileged access to internal systems.
• Access rights are reviewed and revoked promptly upon role changes or terminations.
• All access to production systems is logged and monitored.

2. Encryption in Transit and at Rest

All data transmitted to and from the DocLinQ platform is encrypted using industry-standard protocols. Stored data is encrypted at rest to ensure it remains protected even in the event of unauthorized physical access.

• All network communications use TLS 1.2 or higher.
• Databases and storage volumes containing ePHI are encrypted at rest using AES-256.
• Encryption keys are managed through dedicated key management services and rotated on a defined schedule.
• Sensitive configuration values and credentials are stored in encrypted secrets management systems, never in source code.

3. Secure Software Development Practices

Security is integrated throughout our software development lifecycle (SDLC). We design and build with security in mind from the earliest stages of feature development.

• Code is reviewed by qualified engineers before being merged and deployed.
• Automated static analysis and dependency scanning is applied to identify known vulnerabilities.
• Changes to production systems follow a controlled deployment process with rollback capability.
• Our development and production environments are isolated. No development or test data contains real ePHI.
• Third-party libraries and dependencies are tracked and updated on a regular schedule.

4. Audit Logging

DocLinQ maintains comprehensive audit logs across all platform components to support accountability, anomaly detection, and compliance requirements.

• User authentication events (login, logout, failed attempts) are logged with timestamps and IP addresses.
• Access to and modifications of ePHI are recorded in accordance with HIPAA audit control requirements.
• Administrative actions on infrastructure and configuration are logged separately from application activity.
• Logs are retained for a minimum period sufficient to support incident investigation and regulatory obligations.
• Log integrity is protected to prevent tampering.

5. Vulnerability Management

We maintain an active vulnerability management program to identify and remediate security weaknesses before they can be exploited.

• Regular automated scans are performed on infrastructure and application code for known vulnerabilities (CVEs).
• Critical and high-severity findings are prioritized for remediation on an accelerated timeline.
• Security patches for operating systems and platform dependencies are applied promptly.
• We review security advisories relevant to our technology stack on an ongoing basis.

6. Backups and Data Resilience

DocLinQ implements a robust backup strategy to ensure data availability and recoverability in the event of a system failure, data corruption, or disaster.

• Production databases are backed up on a regular schedule with backups stored in geographically separated locations.
• Backup data is encrypted and access-controlled consistent with primary data protections.
• Backup restoration is tested periodically to verify recoverability and meet defined recovery time objectives (RTO) and recovery point objectives (RPO).
• Backup retention periods are defined to satisfy both operational and regulatory requirements.

7. Incident Response

DocLinQ maintains a documented incident response plan to ensure that security events are identified, contained, and resolved in a timely and organized manner.

• Security incidents are triaged, investigated, and escalated according to defined severity levels.
• In the event of a confirmed breach involving ePHI, we follow HIPAA Breach Notification Rule requirements, including timely notification to affected individuals and the Department of Health and Human Services (HHS) as applicable.
• Post-incident reviews are conducted to identify root causes and implement corrective actions.
• Incident response procedures are tested and updated at least annually.

8. Vendor Risk Management

Third-party vendors and subprocessors that handle or have access to ePHI or sensitive customer data are subject to security and compliance review before onboarding and on an ongoing basis.

• Business Associate Agreements (BAAs) are executed with all vendors that qualify as Business Associates under HIPAA.
• Vendor security posture is reviewed prior to engagement, including an assessment of their controls, certifications, and incident history.
• Vendor access to DocLinQ systems is limited to what is strictly necessary for the contracted service.
• Vendor relationships are reviewed periodically, and BAAs are maintained current.

9. Workforce Security Awareness

Our workforce is a critical part of our security posture. DocLinQ invests in ongoing security awareness to ensure that all team members understand their responsibilities in protecting data.

• All employees complete security and HIPAA awareness training upon onboarding and on a recurring annual basis.
• Personnel with access to ePHI receive role-specific training on safe data handling.
• Phishing simulation exercises are conducted to reinforce awareness of social engineering threats.
• Security policies — including acceptable use, data handling, and incident reporting — are formally documented and acknowledged by all employees.

10. Compliance & Frameworks

DocLinQ's security program has been independently audited against recognized healthcare and security frameworks.

• HIPAA: DocLinQ is HIPAA compliant. Our safeguards for protecting ePHI have been independently audited against the HIPAA Security Rule and Privacy Rule.
• SOC 2: DocLinQ has completed an independent SOC 2 audit against the AICPA Trust Services Criteria.
• We execute Business Associate Agreements (BAAs) with covered entities and their business associates as required under HIPAA.

Request Security Documentation

Our SOC 2 report, security whitepapers, Business Associate Agreements, and additional compliance evidence are available to authorized customers and prospective partners upon request and under appropriate confidentiality terms. To request documentation or ask a security-related question, please contact us: