How Valian protects your data

Valian handles real patient information for your practice: names, birth dates, insurance details and, depending on what you use, appointment and call history. Protecting that data isn't a feature on the side; it's the whole job. This article walks through how we keep your practice's information private, and the parts you hold yourself.

HIPAA and your Business Associate Agreement

Valian is a HIPAA business associate of your practice. You sign our Business Associate Agreement (BAA) when you set up your account, before any patient information goes in. The BAA is the legal promise that covers how we protect, use and, if it ever came to it, report on your patients' information. Your signed copy is kept under Settings → Documents on file, where you can download it any time.

Encryption

Your data is encrypted both while it moves and while it's stored:

• While it moves. Everything between your browser and Valian travels over an encrypted connection (TLS), so it can't be read as it crosses the internet.
• While it's stored. Our database encrypts stored data with AES-256.
• An extra layer for Social Security numbers. An insurance check sometimes needs the subscriber's Social Security number. That number is encrypted again by our own servers before it's saved, and screens only ever show the last four digits.

You don't have to set any of this up. It's on for every practice.

Your practice is walled off from every other

Many practices use Valian, and each practice's data is kept apart. Every record is tagged to your practice, and a database rule called row-level security checks that tag on every read and write. Another practice's login can't see your patients, and every night an automated test tries to read across practices and confirms it's blocked. Valian's own team can open your account to run, support and improve the service, as your BAA and our Terms allow.

Access is logged

Reads of patient information are written to a separate access log. Account activity is recorded in an event log that can be added to, but that no dashboard login can edit or erase. So there's a trustworthy history of what happened and when.

Signed out when you step away

If a dashboard is left open with no activity for 30 minutes, Valian signs it out on its own. That keeps a shared computer left open from staying signed in.

Payments handled carefully

Valian never stores your card number. Your card is held by Stripe, our payment processor, which is certified at the card industry's highest security level (PCI DSS Level 1). We keep only the card's brand, last four digits and expiry date, so we can show you which card is on file.

Backups and checks

Your data is backed up every day. We also keep our own copy in a separate Google Cloud store for 35 days, and we practice restoring it. Every night, automated checks test these safeguards against the live system and flag any that fail to our team.

The controls you hold

The strongest platform still depends on good habits at your office. Here's what's in your hands, and where to manage it:

• Individual logins. Give every teammate their own login, never a shared one, so access can be given and taken away cleanly. See Add another user to your practice.
• The right role for each person. Roles limit each login to what that person actually needs. See Roles and permissions.
• Your own sign-in. Use a strong password nobody else knows, and sign out devices you don't use under Settings → Sign-in & security. See Reset a password and Turn on two-factor authentication.
• Prompt off-boarding. Remove a login the day someone leaves.

Frequently asked questions

Is my patient data used to train AI? Valian never gives identifiable patient information to another company to train its AI. Our Terms and your BAA let Valian use your practice's data to test and improve its own service, including training its own models. You can opt out of general model training any time by writing to help@valiansystems.com.

Can another practice ever see my data? No. Every record is tied to your practice on every read and write, and we test that every night.

Where can I find my signed BAA? Under Settings → Documents on file. Select Download for a private copy. The link expires after a few minutes, so reopen the page for a fresh one.

What happens to my data if I leave Valian? We keep your records after you cancel and delete them when your practice asks us to in writing. Email privacy@valiansystems.com. If you're on Insurance Verification, the page you see after cancelling also has Ask us to delete your data. We confirm your request and delete within 30 days, except anything the law, a legal hold or your BAA requires us to keep. To get a copy of your data instead, ask the same way.

Who do I contact about a security question? Submit a ticket from Help, or email help@valiansystems.com.