ServiceHub Security

HIPAA
SOC 2 Type 2

Security and compliance

ServiceHub protects the data our customers entrust to us from unauthorized access, disclosure, use, and loss. Our policies, procedures, and information systems meet the requirements of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), including the Privacy, Security, and Breach Notification Rules. ServiceHub has also completed a SOC 2 Type 2 examination by an independent auditor, and we provide the report to customers on request.

How HIPAA applies to ServiceHub

ServiceHub schedules and tracks the work of healthcare ancillary service teams. It holds limited patient information needed to schedule work, such as patient name, medical record number, and location. Organizations may also choose to record service or billing codes and caregiver specialties. Because this information is protected health information (PHI), ServiceHub secures all data it stores and transmits for use in a healthcare environment.

When a HIPAA covered entity or business associate uses ServiceHub to handle PHI, we act as a business associate under a Business Associate Agreement (BAA).

Authentication

  • Individual sign-in. Every user must sign in with two-factor authentication or through single sign-on (SSO).
  • Single sign-on. Paid and Enterprise customers can require sign-in through their own identity provider using SAML-based SSO.
  • Credential verification. Users are verified against their work email domain and, where applicable, public credential registries before they are approved.

Authorization

  • Role-based access. Once signed in, users see only the data their role and organization permit, as set in their user profile.
  • Minimum necessary patient information. ServiceHub holds only the information needed to identify the patient and location for a task, not clinical notes or the full medical record. For customers with an EHR integration, ServiceHub can access only the data that integration provides, which varies by integration.
  • Automatic logoff. Sessions end automatically after a period of inactivity or when a connection drops.
  • Advertising isolation. Advertising systems have no access to patient or operational data. See our Advertising Policy.

Accountability

  • Audit trail. ServiceHub records a user, date, and time stamp on every transaction, so customers can see who accessed or changed a record and when.
  • Access logs. Access logs track activity on patient-related records. They capture events and times, not clinical content.
  • Shared responsibility. HIPAA compliance depends on ServiceHub and its customers working together. Customers manage their own users, roles, and access settings. We work with customers who are HIPAA covered entities to implement our respective compliance responsibilities on time and effectively.

Infrastructure and data protection

  • Cloud hosting. ServiceHub is hosted in U.S. data centers that maintain HIPAA-eligible services and independent certifications, including SOC 2 and ISO 27001.
  • Encryption in transit. All data is transmitted over TLS 1.2 or higher.
  • Encryption at rest. Stored data is encrypted with AES-256.
  • Data integrity. Data in transit is protected against tampering with SHA-256-based message authentication.
  • Backups and availability. Data is backed up regularly and replicated to support recovery. Uptime commitments for paid and Enterprise customers are set out in their service level agreement.
  • AI features. Prompts and AI outputs are protected with the same encryption and access controls as other customer data. Third-party AI model providers that process customer data sign a BAA and may not use it to train their own models. ServiceHub may use customer data to train and improve its own models. Our training process is designed to exclude PHI patient identifiers from customer data before it is used for training. If any PHI remains, we use it only as permitted by the applicable BAA. Paid and Enterprise customers may opt out of model training in their Customer Agreement.

Security program

  • Policies. Our security policies are reviewed at least annually. They cover access control, asset management, data protection and retention, incident response, risk assessment, secure software development, vendor management, and vulnerability management.
  • Testing. Code is reviewed and tested for security vulnerabilities before release, and our systems are scanned regularly. We commission an independent penetration test annually.
  • People. All employees complete HIPAA and security training when hired and every year after. Access to production systems is limited to personnel who need it.
  • Vendors. Service providers that may handle PHI sign a BAA and are reviewed before we engage them.
  • Incident response. We maintain an incident response plan. If a breach affects PHI, we notify affected customers as required by HIPAA and our BAAs.

Reporting a vulnerability

We take security reports seriously. If you believe you have found a vulnerability in ServiceHub, email legal@servicehub.com with a detailed description and clear steps to reproduce it or a proof of concept. Please do not access, modify, or delete data that is not yours, and give us reasonable time to fix the issue before disclosing it publicly. We will confirm receipt and keep you informed as we investigate.

Contact us

For security questions, negotiated BAA requests, or security questionnaires, contact support@servicehub.com.