- Home
- Security
Your patients' data, protected
Nuvory is built for HIPAA. HealthArc signs a business associate agreement with every customer, and HealthArc's platform is covered by a SOC 2 Type II report.
Safeguards
HIPAA and BAA
Nuvory is built for HIPAA, and HealthArc signs a business associate agreement with every customer.
SOC 2 Type II
HealthArc's platform is covered by a SOC 2 Type II report from ZeroDayCPA, an independent auditor. Report issued October 19, 2026.
Encrypted and isolated
Data is encrypted in transit and at rest, and each practice's data is kept separate.
Right access for each role
People see only the features and locations their role needs.
Every view audited
Every view of patient information is logged in an audit trail.
Your data stays yours
Your data is used only to run Nuvory for your organization.
How patient data is protected
The same commitments appear in our privacy notice and in the BAA every customer signs. Learn who we are.
| Area | What we do |
|---|---|
| Business associate agreement | HealthArc LLC acts as a HIPAA business associate and signs a BAA with every customer before any patient data is connected. |
| Independent audit | Nuvory runs on HealthArc's platform, which is covered by a SOC 2 Type II report covering May 1 to July 31, 2026, issued October 19, 2026 by ZeroDayCPA, an independent auditor. We share the report under NDA. |
| Hosting | HealthArc's cloud environment in the United States. |
| Encryption | Data is encrypted in transit and at rest. |
| Isolation | Each customer's data is isolated from every other customer's. |
| Access | Role-based access control, with audit logging of access to patient information. |
| Operations | Vulnerability management, security monitoring, workforce training, and incident response and business continuity procedures. |
| Subcontractors | Any subcontractor that handles patient information signs a business associate agreement with HealthArc. |
| Breach notification | Customers are notified of a breach of unsecured PHI without unreasonable delay, and no later than 5 days after discovery. |
| Use of patient data | PHI is never sold or used for marketing, advertising or tracking pixels. De-identified data is used only as the BAA permits. |
| Clinical decisions | Stay with your clinicians. Nuvory supports clinical judgment and does not replace it. |
Questions, answered
More in our FAQ, or ask our team.
Is Nuvory HIPAA compliant?
Nuvory is built for HIPAA. HealthArc acts as a business associate, signs a business associate agreement with every customer, and HealthArc's platform is covered by a SOC 2 Type II report covering May 1 to July 31, 2026, issued October 19, 2026 by ZeroDayCPA, an independent auditor. There is no official HIPAA certification; the BAA and the safeguards behind it are what matter.
Where does patient data live?
In HealthArc's US cloud environment, encrypted in transit and at rest, with each practice's data isolated at the database level.
Can we review your security documents?
Yes. We share our SOC 2 Type II report and answer your security questionnaire under NDA. Use the contact form and choose "Security documents".
What data does Nuvory read from our EHR?
Only what it needs to find open referrals, orders, recalls and appointments: patients, encounters, orders, referrals, appointments and, where connected, claims. The exact scope is agreed with your team during implementation.
See who your practice is missing
In a 30-minute demo, we'll show you the patients and revenue a practice like yours can bring back.