Encryption
Application traffic is encrypted in transit with HTTPS and TLS. Managed infrastructure provides encryption at rest. Clinical free text receives additional application-level protection.
A practical approach to PHI
Rewire Clinical is designed to support clinicians and organizations that handle protected health information. We use administrative and technical safeguards intended to limit access, protect stored information, and preserve a reviewable history of activity.
No software makes good privacy practice automatic. Clinicians still decide what belongs in a record, who should have access, and when client access should end.
Business Associate Agreements
For individual practitioner accounts: Rewire provides a BAA with the practitioner. Individual accounts are designed for independent clinical use and are not treated as a lesser or non-compliant option.
For facilities and organizations: the facility tier provides a direct BAA between the organization and Rewire. That direct organizational agreement is the structure Joint Commission, CARF, and many state regulators generally expect covered entities to maintain with business associates.
If you are choosing between account types, tell us how your clinicians are employed, how records are supervised, and which entity is the covered entity. We can help identify the right agreement structure without guessing at your legal obligations.
Controls around the record
Access controls
Unique accounts, role-based permissions, and database row-level security restrict records to authorized users and the clients assigned to them.
Audit logging
Security-relevant and PHI access activity is recorded so an organization can investigate access and support compliance review.
Client access
Clinicians control which clients receive guided app access and can remove that access when care changes or ends.
Shared responsibility
Keep account credentials private, use supported devices and browsers, review staff access promptly, and remove access when a role changes. Clinicians are responsible for appropriate consent, documentation choices, and applicable record-retention duties in their jurisdiction.
Our Privacy Policy explains data handling in more detail. Platform rules are in the Terms.
Security and BAA questions
Write to privacy@rewire-emdr.com. For an organization review, include your entity name, care setting, and the account tier you are considering. Please do not send PHI by email.