Top Considerations for Student Health Records Software Security and Privacy
Written by: Chris Kempton, VP of Software Development and Product at DocNetwork
From immunization records and medication schedules to allergy action plans and behavioral health notes, school health offices collect large amounts of protected health information every year — and the software they use to store it plays a huge role in keeping it secure. As a leading student health record software provider trusted by more than 1,250 schools and youth program organizations, SchoolDoc takes that responsibility seriously.
Learn how we approach security and privacy so you have peace of mind that your students’ health information is safe with us.
How does SchoolDoc align with the key principles of information security?
At SchoolDoc, we follow the five Trust Services Criteria of the SOC 2 computing standards: Security, Confidentiality, Privacy, Availability, and Processing Integrity.
While an organization can technically call itself “SOC 2 Compliant” by only demonstrating Security, we insist that our auditors hold us accountable for all five principles since they apply to our business.
What this means for you: our data is rigorously protected against unauthorized access, stays complete and accurate from start to finish, and runs on reliable infrastructure that keeps it available whenever it’s needed.
Does SchoolDoc support Multi-Factor Authentication (MFA)?
Yes, MFA is available to SchoolDoc users. Admins can require MFA for every user at their school which we strongly recommend. SchoolDoc employees are required to use MFA to access all critical infrastructure.
Does SchoolDoc support Single Sign-On (SSO)?
Yes, organizations can now sign their users into SchoolDoc through their own institution’s identity provider using the SAML standard. If an organization is not using a SAML-compliant identity solution, we also offer a custom API-driven option. SSO helps our clients offboard employees easier and reduces the chance that a forgotten credential stays active.
Is SchoolDoc SOC 2 Type 2 compliant?
Yes. Sensiba, LLC audits us every year for compliance with all five SOC 2 Trust Services Criteria. We also use Drata to monitor our compliance continuously and help us keep compliance front and center. Visit trust.docnetwork.org to review our annual auditors’ reports and policy documents supporting our compliance.
Is SchoolDoc FERPA compliant?
Yes. The Privacy controls within the SOC 2 standard align with FERPA law, so our audited compliance provides assurance we’re on the right path.
SchoolDoc’s role-based permissions allow schools to decide which staff can see which records. For example, a teacher can see a student’s allergy action plan without seeing behavioral health notes. As we add new features, we build in the same access controls.
Is SchoolDoc HIPAA compliant?
Yes, Sensiba assesses our HIPAA safeguards each year. For most schools, student health records fall under FERPA, which we covered above. HIPAA can apply in some situations, like a campus clinic run by an outside health system, and SchoolDoc’s safeguards are built to meet both standards. You can view our latest HIPAA compliance report in our Trust Center.
Does SchoolDoc integrate with other platforms?
We maintain an ever-growing list of integration partners, including prominent Student Information Systems. We understand that running a great school requires administrators to solve many different problems using different software platforms. Our API enables secure data transmission between platforms to eliminate manual data synchronization.
For more information about SchoolDoc’s security and privacy protocols, read our quick guide or contact sales@schooldoc.com.
1,250+ programs nationwide choose SchoolDoc. Fill out the form to get in touch with our sales team.
Schedule a Demo Today!
Complete the form to find out why more than 1,250 programs nationwide choose SchoolDoc.
Schedule a personalized walkthrough.
