MohsBinder is built for HIPAA compliance and designed to support CLIA and 21 CFR Part 11 workflows. Below is a plain description of how the product actually handles data today, not a checklist of certifications we do not hold.
Encryption in transit and at rest
The Site and the MohsBinder application are served over HTTPS. Application data is stored on Google Cloud infrastructure (Firebase), which encrypts data at rest by default.
Tamper-evident audit trail
Every signed record is chained into an append-only audit trail secured with SHA-256 hashes. Corrections are handled as voids, not deletions: a voided record stays visible with the reason, the director who voided it, and a timestamp, and the chain records the void event itself. Nothing archives unsigned.
Role-based access control
Access is scoped by role. Technicians, surgeons and lab directors, reviewing providers, and inspectors each see only the records their role permits, enforced by server-side rules rather than by hiding buttons in the interface. Sensitive state changes, such as voiding a record or changing an employee's status, run through server-side functions rather than direct client writes, and are themselves recorded in the audit trail.
Inspector access
During a CLIA survey, staff hand the surveyor a one-time QR link that opens a neutral, read-only view of records. The link expires automatically 8 hours after issuance, no staff account is shared, and no patient data is embedded in the QR code. Inspector sessions are themselves logged.
Document control and e-signatures
Standard operating procedures are version-controlled: each effective version is signed, its content hash is computed and bound to the signature, and prior versions are archived rather than overwritten. Daily QC, corrective action, competency, and peer review forms use the same signed, chained record model, consistent with 21 CFR Part 11 recordkeeping practices.
What we do not claim
MohsBinder is not HIPAA certified (no such government certification exists) and has not undergone a SOC 2 audit. We describe our architecture accurately rather than overstate it, and we will update this page if that changes.
Reporting a security issue
If you believe you have found a security issue, email contact@mohsbinder.com with details and we will follow up.