Security at PracticeLien

Our approach

PracticeLien handles patient, case, and lien data for personal-injury medical practices. We design every layer of the service - infrastructure, application, data, and process - to protect protected health information (PHI) and minimize the blast radius of any single failure.

Infrastructure

• Cloud provider. The application runs on Microsoft Azure in the Central US region. PHI is processed on Microsoft Azure and on a short list of vendors that have signed BAAs (see the subprocessor list). Microsoft's HIPAA Business Associate Agreement applies to eligible customers through the Microsoft Product Terms and Data Protection Addendum.
• Compute. The web application runs on Azure App Service. Scheduled and queue-triggered sync workers run as Azure Container Apps jobs.
• Database. Azure SQL Database. Production databases are reachable only over a private endpoint. Backups are managed by the Azure SQL service.
• Secrets. Credentials are stored in Azure Key Vault and read at runtime by managed identities. They are not committed to source code.
• Infrastructure as code. Infrastructure is defined in Terraform and reviewed before apply.

EMR integration

PracticeLien reads patients, appointments, billing, and documents from your EMR. It writes back only two things: a patient record when a referral converts, and the case ID on appointments. It never writes clinical documentation, billing, or lien data, and it does not replace any EMR form.

Multi-tenant isolation

Every customer (medical practice) is a distinct tenant. Tenant boundaries are enforced inside the database, not just in application code:

• Every PHI-bearing table has a non-null tenant_id column and a row-level security policy in Azure SQL Database that filters rows by the current session's tenant.
• The tenant identifier is resolved from the authenticated session and set on the database connection as locked, non-changeable session context before any query runs, so a pooled connection cannot switch tenants.
• Cross-tenant queries are blocked by the database itself - even a buggy or malicious application query cannot return another tenant's rows.
• Every new feature ships with an isolation test that asserts a request authenticated as Tenant A cannot read Tenant B's data.

Authentication and access

• Identity provider. Authentication is provided by Clerk (SOC 2 Type II, BAA available).
• Multi-factor authentication is available on every account.
• Role-based access control. User roles (admin, provider, front desk, billing) determine which actions and screens are available within a practice.
• Attorney portal. Attorneys log in to a scoped portal that exposes only the cases their firm is associated with - they never see practice-staff screens or other firms' data.
• Internal access. Our policy is to limit production access by PracticeLien staff to the minimum set of engineers needed.

Encryption

• In transit. All traffic to and from the application is encrypted with TLS 1.2 or higher.
• At rest. Azure SQL Database, Azure Blob Storage, and Azure Key Vault encrypt data at rest using Microsoft-managed keys.
• Document storage. Settlement packets and uploaded records are stored in Azure Blob Storage with tenant scoping. Downloads use short-lived shared access signature (SAS) links rather than public URLs.

Logging and auditing

• PHI access and tenant-scoped data changes are recorded in an append-only audit log.
• Application logs are structured JSON, centralized in Azure Monitor and Log Analytics, and scrubbed for PHI before leaving the perimeter (e.g., on the way to error monitoring).
• Audit logs are retained per the customer's BAA and applicable law.

Backups and recovery

• Database backups are automated by Azure SQL Database and encrypted at rest.
• Backups stay in US Azure regions covered by the same BAA.

Software development

• Code review. All changes go through pull-request review before merge to the protected main branch.
• Automated checks. Tests, type checks, and an automated check that blocks PHI in URLs run on every pull request.
• Deployment. Releases are built and deployed by automated pipelines. CI/CD authenticates to Azure through Microsoft Entra Workload Identity Federation - no long-lived deployment keys.

Vendor management

We maintain BAAs with every subprocessor that touches PHI. A current list of subprocessors is on the Privacy page.

Compliance posture

• HIPAA. We sign a BAA with every customer before any PHI is processed, and we maintain BAAs with the vendors that touch PHI. Administrative, technical, and physical safeguards are aligned with 45 CFR Part 164.
• SOC 2. A SOC 2 Type I report is on our roadmap. We are operating with SOC 2 controls in mind from day one.

Responsible disclosure

If you believe you have found a security vulnerability in PracticeLien, please email info@sevenseasstrategies.com. Please include enough detail to reproduce the issue, and give us a reasonable window to investigate before public disclosure.

• We will acknowledge receipt within two business days.
• We will not pursue legal action against good-faith researchers who follow this policy.
• Please do not access more data than necessary to demonstrate the issue, and never use real patient PHI in a test or proof of concept.

Contact

For security questions, BAA requests, or to report a suspected incident:

Seven Seas LLC · info@sevenseasstrategies.com