Where Epic collects or receives personal information, it uses technical controls and safeguards
Epic says that in the limited situations where it collects or receives a patient's personal information, for example when the patient contacts Epic for support, it uses technical controls and safeguards to protect the privacy, security, integrity and availability of that information. It also says the mobile apps use technical controls and safeguards to help keep information safe while the patient uses them.
Supporting quotations
How We Protect Your Personal Information
In the limited situations where Epic collects or receives your personal information (for example, if you contact us for support), we use technical controls and safeguards to protect the privacy, security, integrity, and availability of your personal information.
Our mobile apps also use technical controls and safeguards to help keep your information safe while you use our mobile apps.
Personal Information Collected From You (If You Contact Us)
we may keep a record of the communication
Qualifications & exceptions
Limited to situations where Epic collects or receives the patient's personal information.
The apps' own safeguards are described as helping to keep information safe, which is softer wording than a guarantee.
Not stated here
The passage does not describe the safeguards used by Epic outside the mobile apps in detail; the following lists describe some.
Security & Safeguards · Company practice
The apps use multi-factor authentication by default unless the healthcare organization changes it
The mobile apps use multi-factor authentication by default, and it is required when using the apps. The exception is that a patient's healthcare organization can make or allow changes to this control.
Supporting quotations
Safeguards and Controls Built Into Our Mobile Apps
Our mobile apps use multi-factor authentication by default.
Multi-factor authentication is required when you use our mobile apps unless your healthcare organization makes or allows changes to this control.
Qualifications & exceptions
Stated as the default and as required, but a healthcare organization may make or allow changes to this control.
Not stated here
The passage does not say what changes a healthcare organization may allow or whether patients are told when the control is changed.
Security & Safeguards · Company practice
Data stays in app-private storage other apps cannot reach; saved files go elsewhere only with your explicit permission
Epic says the mobile apps store data on the device in app-private storage that other apps cannot access. Files a patient downloads or saves from the apps may be placed in locations other apps can reach, such as the files app, but only with the patient's explicit permission. This is the storage the earlier list refers to for temporary copies of photos, videos and documents.
Supporting quotations
Our mobile apps store data on your mobile device in app-private storage that cannot be accessed by other apps.
Files you download or save from our mobile apps may be placed in locations accessible to other apps, such as your files app, only with your explicit permission.
a temporary copy of your chosen photo is stored in our mobile app via app-private storage on your device
If you use the camera app on your device to take new photos or videos, temporary copies are stored on your device in app-private storage.
Qualifications & exceptions
The inaccessibility claim is about other apps on the device and about app-private storage.
Files a patient saves or downloads can end up in locations other apps can access, only with explicit permission.
A camera app may save its own copy of a new photo outside app-private storage, as the earlier list says; that copy is outside this description.
Not stated here
The passage does not address access by the device's operating system, backups, or other people using the device.
The apps use in-app notifications and permission requests to help you decide when data is shared with other apps
Epic says the mobile apps use in-app notifications and permission requests to help patients make informed decisions about when and how their data is shared with other apps on their device.
Supporting quotations
Our mobile apps use in-app notifications and permission requests to help you make informed decisions about when and how your data is shared with other apps on your device.
Qualifications & exceptions
The sentence is about sharing with other apps on the patient's device.
Not stated here
The passage does not list which notifications or permission requests appear.
Security & Safeguards · User right or choice
Screenshots are disabled by default on Android, cannot be disabled on iOS, and Android users can enable them
On Android devices the mobile apps disable screenshots by default, and Android users can turn screenshots on if they want. Epic says it cannot disable screenshots on iOS, so the protection applies to Android only.
Supporting quotations
Our mobile apps disable screen-shot functionality by default for Android devices (we cannot disable this functionality in iOS).
Android users can enable the function if they want to.
Qualifications & exceptions
The default protection is for Android only.
Epic says it cannot disable screenshots on iOS.
Android users can enable the function.
Security & Safeguards · Company practice
The apps use https for secure communication with servers
Epic says the mobile apps use https for secure communication with servers.
Supporting quotations
Our mobile apps use https for secure communication with servers.
Qualifications & exceptions
The statement concerns the apps' communication with servers.
Not stated here
The passage does not say which servers or describe other protections for data in transit.
Security & Safeguards · Company commitment
Epic limits internal access to information you send it to staff who need it for their jobs
Epic says it maintains internal policies and processes that limit access to the information a patient sends to Epic to staff who need to know the information to do their jobs.
Supporting quotations
Additional Steps We Take At Epic
At Epic, we maintain internal policies and processes that limit access to the information you send to us to our staff who need to know the information to perform their jobs.
Qualifications & exceptions
Applies to information the patient sends to Epic.
Not stated here
The passage does not describe how the policies are enforced or audited.
Security & Safeguards · Context
Your healthcare organizations use their own safeguards; ask them about those
Epic says each healthcare organization a patient connects to through the apps also uses safeguards to protect the patient's information, and tells the patient to contact the organization with questions about its safeguards.
Supporting quotations
Each healthcare organization you connect to through our mobile apps also uses safeguards to protect your information.
Contact them if you have any questions about their safeguards.
Qualifications & exceptions
The safeguards described are those of the healthcare organizations, not Epic.
Not stated here
The healthcare organizations' safeguards are not described in this document.
Security & Safeguards · Procedure
Steps Epic suggests you take: protect your password, use device security tools, and do not root or jailbreak
Epic lists steps a patient can take to protect their information: do not share the username and password used with the mobile apps, change the password immediately if unauthorized access is suspected, use the security tools on devices used with the apps, and do not root or jailbreak those devices. Epic explains that rooting or jailbreaking can create security risks by removing built-in device protections and exposing sensitive information on the device.
Supporting quotations
You can take other steps to protect your information:
Do not share the username and password you use with our mobile apps.
Change your password immediately if you believe any unauthorized access has occurred.
Use the security tools on devices you use with our mobile apps.
Do not root or jailbreak devices you use with our mobile apps. Doing so can create security risks by removing your devices’ built-in security measures and exposing sensitive information on your device.
Qualifications & exceptions
These are presented as steps the patient can take, written as instructions.
The policy gives a reason only for the root and jailbreak instruction.
Not stated here
The policy does not say what follows if a patient does not follow these steps.
Security & Safeguards · Context
The saved text ends with a security vulnerability reporting heading and no instructions
The saved policy ends with headings 'Security' and 'Report a Potential Security Vulnerability or Concern'. No text, contact method or process appears under them in the saved copy, so it does not say how to report a vulnerability.
Supporting quotations
Security
Report a Potential Security Vulnerability or Concern
Qualifications & exceptions
Only headings are present in the saved text.
Not stated here
How to report a potential security vulnerability or concern is not shown in the saved text.