Security & Compliance

Built to protect
patient photos and records.

CureCast combines seven security controls to manage who accesses patient information, what activity is recorded, and how data is protected at rest and in transit.

  • Staff Access Control: who can access what
  • Audit Trail : What activity is recorded
  • Device Management : Which devices have CureCast access
  • Session Timeout : How inactive sessions are handled
  • Encryption : How patient records and clinical photos are protected
  • Confidential Patient : invisible to unauthorised staff
  • Multi-Clinic : How access stays scoped to a single clinic location
Supports compliance for
HIPAA GDPR PHIPA Australia Privacy Act
By Vishal Parikh, Founder, CureCast · Updated September 30, 2026
SECURITY OVERVIEW
Practice Security Status
7 controls in place
All Active
👤
Staff Access Control
Active
📋
Audit Trail
Active
📱
Device Management
Active
⏱
Session Timeout
Active
🔒
Encryption
Active
🔐
Confidential Patient Access
Active
🏥
Multi-Location Access
Active
Seven security controls working together
Security active
Security
7 controls active
Patient data
Protected

How CureCast Protects Patient Information

Each control is explained in detail on its own page. Together they cover who has access, what gets recorded, which devices are trusted, how long a session stays open, how data is protected while it’s stored and moved, which individual patients need an extra layer of privacy, and how access stays scoped to a single clinic.

Staff Access Control

Administrators control staff access to patient records, clinical photos, albums, and sensitive actions through module-level and action-level permissions. For multi-location practices, access is scoped to each clinic account.
See how staff permissions work →

Audit Trail

CureCast records defined activity across patient records, files, clinical modules, consent workflows, and exports — with staff, device, IP, and timestamp context. Filter and export in CSV or PDF.

See how audit trail works →

Device Management

Administrators can review every device connected to their account and end a session when a device is lost, stolen, or no longer trusted. Deactivating a staff account ends sessions across their devices.

See how device-management work →

Session Timeout

CureCast automatically ends inactive sessions after 2 hours on desktop and 4 hours on supported mobile devices, with a warning before logout and a required sign-in to continue.

Learn about reauthentication →

Encryption

Patient records and clinical photos are encrypted at rest using AES-256 and protected in transit using TLS, with TLS 1.3 as the primary protocol and TLS 1.2 supported as a fallback.

Learn about Encryption →

Confidential Patient Access

Mark a patient confidential and their record no longer appears in search results, patient lists, or before-and-after galleries for staff who don’t hold that specific permission. Only an administrator can grant it, per staff member.
Learn about Confidential Patient Access →

Multi-Clinic Photo Management

Keep clinic locations separated while giving central administrators visibility across the practices they oversee. Each location operates within its own account, helping keep patient records and clinical photos organized by clinic.
See how multi-clinic photo management works →

  Beyond the Software

Canada (PHIPA)

If your practice operates in Ontario, patient photographs and other health information are subject to provincial privacy requirements. See our Canada PHIPA guide for the privacy rules relevant to clinical photo management.

United Kingdom

UK practices handling identifiable patient photographs need to consider UK data-protection requirements. Our UK and EU GDPR guide explains how those requirements relate to clinical photo management.

United States (HIPAA)

US practices handling protected health information, including identifiable patient photographs, need to consider HIPAA requirements. See our US HIPAA guide for information on privacy and security considerations for clinical photo management.

Australia

Australian practices need to consider the Privacy Act when collecting, storing and using identifiable clinical photographs. See our Australia Privacy Act guide for the relevant privacy requirements.

Security and compliance involve more than individual software features. Practices also need policies and procedures for access reviews, patient-photo consent, device security, incident response, staff offboarding, and applicable privacy laws.

Book a CureCast demo for clinical photo management software

See How CureCast Fits Your Practice

Discuss how CureCast fits into your clinical photo workflow, from capturing and organizing patient photos to securely managing them across your practice.

Prefer email? [email protected]