Where your patient data actually lives

The question under every other question

Ask a clinical software vendor where your charts live. In most cases, the honest answer is: on their servers, in their account, under their control.

That answer has consequences. Your PHI now sits somewhere you cannot inspect, governed by terms you did not write. And the vendor, holding thousands of practices' records in one place, becomes a permanent and attractive target.

We built LogBlues on a different answer. Records stay on the machines in your practice. There is no copy of your patients on our servers, because normal use never sends one. That is not a policy we promise to honor. It is how the software works.

The LMLSE: the layers, from the outside in

Keeping data local is the foundation, not the whole building. A local file is only as safe as the machine holding it. So the LogBlues Multi-Layered Security Exosystem uses safeguards that reinforce one another across the device, stored data, permissions, protected screens and security activity.

• Layer 1, the device. Before the app trusts a machine, it checks it: disk encryption enabled, screen lock present, no signs of tampering. An untrusted device does not get to be a quiet exception.
• Layer 2, at rest. Credentials and keys live in the operating system's own secure store, Windows DPAPI. Never a homemade key file. Local data is encrypted at rest.
• Layer 3, permissions. Role-based access control is applied where data is read, not merely where a button is drawn. Hiding a menu item is not security; it is decoration.
• Layer 4, the second door. Screens holding real PHI require re-authentication. A one-time code is emailed from a domain-verified, DKIM-signed sender, generated from a cryptographically secure source and expiring in ten minutes. The unlock lasts for that session only and ends at sign-out.
• Layer 5, the trail. The Security screen gives authorized staff a readable record of protected-result verification, exports and security-policy activity, paired with encrypted local export.

On compliance, said plainly

LogBlues is HIPAA compliant from day one. Encryption at rest, role-based access, protected-screen re-authentication and security activity are built in rather than bolted on.

Here is the honest part. Compliance is a property of a practice and its agreements, not of software alone. It depends on your policies, your training, your business associate agreements, and how your staff actually behaves on a busy Thursday. Any vendor who tells you their product makes you compliant is selling you a feeling.

What software can do is make the right thing the default and the wrong thing difficult. Keep the data where you can see it. Encrypt it. Check the machine. Gate the sensitive screens. Log every look. Then, when sync arrives, refuse to loosen any of it for convenience.

You should not have to trust us with your patients to use our software. That is the point of building it this way.