Security

Secure by having less to protect

We built healthcare.dev so it never needs patient data. Here's how we protect the rest.

Practices

No PHI by design: The API serves public reference data and our terms forbid sending patient information. There is no patient data to breach, and no HIPAA business associate relationship.
API keys: Keys are shown once. We store a peppered HMAC-SHA256 hash and a short public prefix, never the key. Revoked keys stop working within 30 seconds.
Encryption: TLS on every connection from clients to our edge and inside the data tier; databases, caches, backups and secrets are encrypted at rest.
Infrastructure: The API runs on AWS (ECS Fargate, Aurora PostgreSQL) behind CloudFront and AWS WAF, defined entirely in code (AWS CDK) and deployed only from reviewed commits on main. The website and docs run on Vercel, separately from the API.
Access: Production access is limited to the people who operate the service. CI deploys with short-lived OIDC credentials, not stored keys, and application secrets live only in GitHub's protected prod environment and AWS Secrets Manager.
Data integrity: Every dataset release is validated against quality gates before it's published, and publishing is an atomic switch between immutable versions. A bad upstream file can't replace good data.
Backups: Point-in-time database backups for 35 days; deletion protection on production databases.

Report a vulnerability

Found something?

Email security@healthcare.dev with the details and steps to reproduce. We acknowledge reports within two business days and keep you updated until it's fixed. Please don't access other customers' data, degrade the service or publicly disclose the issue before we've fixed it. We won't take legal action against good-faith research that follows these rules.

Our machine-readable policy is at /.well-known/security.txt. Compliance (SOC 2) is on our roadmap; ask us at hello@healthcare.dev if you need a security questionnaire answered.