Frequently Asked Questions

Data Handling

How is patient data stored?

Patient data is stored in an encrypted relational database with strict tenant and workspace isolation. Each record is automatically scoped to the workspace that created it. No workspace can access another workspace's data, even within the same organization.

Is data encrypted?

Yes, data is encrypted both in transit and at rest:

• In transit — All API communication uses TLS 1.2+ encryption
• At rest — Database storage uses AES-256 encryption
• Credentials — Passwords and secrets are hashed using industry-standard one-way algorithms
• Documents — Stored in encrypted cloud storage

How long is data retained?

Data retention is configurable per workspace. Audit logs are retained according to your organization's compliance requirements (minimum 6 years recommended for HIPAA). Active patient and encounter records are retained indefinitely unless explicitly archived.

Can I export my data?

Yes. All data accessible through the NeuralRev dashboard is also available via the API. You can programmatically export patients, encounters, claims, and payments. For bulk data export needs, contact support to arrange a data extract.

What happens to data when a workspace is deactivated?

When a workspace is deactivated, all associated data remains stored but becomes inaccessible through the application. Data is not deleted. Reactivating the workspace restores full access. Permanent deletion requires a formal request and is irreversible.

---

Security

Is two-factor authentication required?

Yes. Two-factor authentication (TOTP-based) is required for full dashboard access. Users who have not completed 2FA setup are restricted to basic profile management until they enable it. This ensures that all users accessing patient data have an additional authentication factor.

How are API keys secured?

API keys follow security best practices:

• Generated with cryptographic randomness and prefixed with nrev_
• The full key is displayed only once at creation (it cannot be retrieved later)
• Stored as an irreversible hash (not in plaintext)
• Scoped to a single workspace
• Can be immediately deactivated or permanently deleted
• All API key usage is logged in the audit trail

What happens after failed login attempts?

After exceeding the failed login threshold, the account is temporarily locked for a configurable duration. Additionally, rate limiting prevents brute-force attacks from a single source. Multiple independent safeguards apply to protect accounts.

How are webhooks secured?

Every webhook delivery is cryptographically signed:

• Each webhook endpoint has a unique secret (prefixed whsec_)
• The request body is signed and included in the X-Webhook-Signature header
• A timestamp is included in X-Webhook-Timestamp for replay protection
• Secrets can be rotated without downtime
• Failed deliveries are retried with exponential backoff
• All deliveries are logged and inspectable

Are sessions automatically expired?

Yes. Sessions have multiple expiration mechanisms:

1. Idle timeout — Sessions expire after a period of inactivity
2. Maximum age — Sessions are forced to expire regardless of activity
3. Concurrent limit — Each user has a maximum number of active sessions

---

Compliance

Is NeuralRev HIPAA compliant?

Yes. NeuralRev implements technical safeguards required by HIPAA:

• Access controls — Role-based permissions with minimum necessary access
• Audit controls — Immutable audit logs tracking all PHI access and modifications
• Integrity controls — Tamper-evident audit records with cryptographic verification
• Transmission security — TLS 1.2+ for all data in transit
• Authentication — Two-factor authentication, session management, account lockout

A Business Associate Agreement (BAA) is available for covered entities and their business associates.

How are audit logs maintained?

Audit logs are maintained with the following guarantees:

• Immutability — Audit records cannot be modified or deleted once written
• Integrity — Each record includes a cryptographic hash for tamper detection
• Completeness — All data access, modifications, and administrative actions are logged
• Retention — Logs are retained according to compliance requirements
• Performance — Audit capture does not impact API response times

Who can access patient data?

Only users with the appropriate role-based permissions can access patient data:

• Users must have specific read permissions to view patient records
• Users must have encounter-level permissions to view encounter details
• All access is logged in the audit trail, including the specific records viewed
• Data is further scoped by workspace — users can only see data in their assigned workspace

Is there a SOC 2 report available?

Please visit our Trust Center for information about our SOC 2 compliance status, including current system status, incident history, and security practices.

How do you handle data breach notification?

In the event of a data breach, NeuralRev follows established incident response procedures:

1. Immediate containment and investigation
2. Assessment of affected data and individuals
3. Notification to affected covered entities within regulatory timeframes
4. Cooperation with breach investigation and remediation
5. Post-incident review and control improvements

---

Integration

How do I connect my EMR system?

NeuralRev provides a REST API designed for EMR integration:

1. Generate an API key in Settings > API Keys
2. Configure your EMR to send data to the Integration API endpoints
3. All endpoints use upsert semantics — send the same record multiple times safely
4. Set up webhooks to receive real-time notifications when data changes in NeuralRev

See the API Reference for complete endpoint documentation.

What formats are supported for documents?

Document uploads support:

• PDF — Clinical notes, authorization letters, medical records
• DOCX — Word documents for letters of medical necessity

Maximum file size: 250 MB per document.

Documents are uploaded via multipart form data to the encounters document endpoint and stored securely in encrypted cloud storage.

Is there a rate limit?

Yes. Rate limits are enforced to ensure platform stability:

• A global per-IP rate limit applies to all API requests
• Stricter limits apply to authentication-related endpoints

When rate limited, the API returns HTTP 429 with a retryAfter value indicating when you can retry.

How do I test webhooks?

NeuralRev provides built-in webhook testing:

1. Create a webhook endpoint in Settings > Webhooks
2. Use the Test button to send a sample payload to your endpoint
3. View Delivery Logs to see the request/response for each delivery
4. Retry failed deliveries individually from the delivery details page

You can also inspect the full request headers, body, and response for each delivery attempt.

What webhook events are available?

NeuralRev can notify your systems about the following events: