Security controls, stated from current code

Controls implemented today

• Client-specific backend configuration

  The shared frontend resolves a client configuration by subdomain and uses that client's API and Cognito identifiers. AWS account ownership and deployment boundaries are confirmed during onboarding; the website does not assume one arrangement for every customer.

• Encrypted AWS storage

  The primary DynamoDB table uses AWS-managed encryption. Report and AI-document buckets use S3-managed encryption and block public access. CareMAR does not claim a dedicated customer-managed KMS key for every resource.

• Transport enforcement

  S3 buckets deny non-SSL requests and application traffic uses HTTPS endpoints. CareMAR does not publish an unverified claim that every path is restricted to one TLS version or cipher suite.

• Cognito access controls

  Cognito sign-in supports optional authenticator-app TOTP MFA. SMS fallback is not configured. The application keeps auth tokens in sessionStorage and applies a 15-minute client-side idle lock.

• Append-only audit records

  The audit service writes new audit items and its request role is denied update and delete operations on audit records. Clinical record behavior remains governed by each feature's validated contract.

• Role-based authorization

  Facility administrator, nurse, and CNA permissions are enforced by service handlers. Sensitive workflows such as controlled-substance counts add role and witness checks.

• Point-in-time recovery and retained tables

  The primary DynamoDB table has point-in-time recovery enabled and a retain removal policy. This is not a claim of daily S3 backups or a default seven-year S3 retention policy.

• Versioned document storage

  The AI-document bucket is versioned. Generated-report storage follows its own lifecycle, so retention must be described per resource rather than as one universal backup promise.

Recovery and retention are resource-specific

DynamoDB point-in-time recovery protects the primary table, and the table is retained if its stack is removed. Uploaded AI documents use versioned S3 storage. Generated reports use a separate bucket and lifecycle. Those controls do not equal a daily S3 backup with universal long-term retention.

Before onboarding, CareMAR documents the deployed account boundary, enabled recovery controls, export scope, and the retention settings that apply to that facility.

Continuity and export scope

CareMAR currently provides defined PDF and CSV report workflows plus original-file download for stored AI documents. It does not promise an arbitrary full-system CSV/PDF export for every record and time window.

Service continuity depends on the deployed AWS resources, account access, application code, and the applicable agreement. We confirm those responsibilities during onboarding instead of making an unconditional website promise.

Incident and compliance questions

Incident duties and notification timing depend on the facts, applicable law, and signed agreements. This page does not assert an unverified internal response SLA or outside-counsel arrangement. See the HIPAA safeguards page for the current design mapping.