AuthChase is prior-authorization tracking software for medical offices. A HIPAA compliance program, a signed BAA, and a certification are in progress. This page describes what the software does today. It is not a claim that a particular deployment meets the HIPAA Security Rule.
Accounts belong to one organization. Staff can work cases. Admins invite people, export data, and delete the organization. Sessions are httpOnly cookies that lock after 30 minutes idle and end after 12 hours. Admins can require an authenticator code (TOTP) for every person. Signing out of one session revokes that server-side session.
Initials, notes, timeline text, and raw inbound mail are encrypted with AES-256-GCM before they are stored. New ciphertext names the key version. A previous key can stay configured while an admin re-encrypts existing rows. The application does not store a patient name, MBI, address, or date of birth.
Sign-in, case views, case changes, imports, and exports are written to an audit log. New rows are hash-chained to the previous row for that organization. Older rows from before the chain existed are left unmarked. The database administrator can still edit rows, so this is tamper-evidence, not a separate immutable store.
A business associate agreement is not offered yet. Keys are environment variables, not a KMS. There is no SSO. Rate limits are stored in the application database and are not a substitute for an edge firewall. Do not put real patient identifiers into AuthChase until those gaps are closed for your deployment.