Skip to main content

Setting the Industry Standard for Reliability & Redundancy

Medicat Secure Hosted Technology

Medicat’s hosted solution sets the industry standard for security and uptime, with a 99.9% Service Level Guarantee. That means you can be confident that your data is safe and your system will be available when you need it most.

Hosted clients benefit from a secure, Medicat-owned private cloud infrastructure housed within a TierPoint Type 2 SOC 2 and SOC 3 facility, which is certified at a Tier III Standard by the Uptime Institute and located in Research Triangle Park, NC.

Medicat’s private cloud infrastructure is designed to a Fault Tolerant, High Availability 2N standard. At the Research Triangle Park facility, there are two independent, wholly duplicated, Medicat data centers, each with N+1 Fault Tolerant, solid state hardware enabling stateful (real-time) internal failover of all SAN and network components.

One data center is designated for Production and the other as a Hot Standby. Client data, all encrypted at rest, is synchronously replicated across both data centers in real-time. Should the Production data center suffer non-recoverable hardware, software, or operating system failure, users would be immediately redirected to the Hot Standby data center with no loss of data or time.

This High Availability architecture meets the industry’s 2N best practice standard and enables the 99.9% uptime guarantee.

database security

Certifications Achieved

SOC 2, Type II

SOC 2 is a security and compliance standard that offers guidelines for service organizations to protect sensitive data from unauthorized access, security incidents, and other vulnerabilities. This report provides assurance that an organization has adequate systems and controls in place to protect critical information.

TX-RAMP, Level II

The Texas Risk and Authorization Management Program (TX-RAMP) provides a standardized approach for security assessment, certification, and continuous monitoring of cloud computing services that process the data of Texas state agencies. For example, TX-RAMP covers public schools and universities within Texas.

99.9% Service Level Guarantee

SOC2 Process

Disaster Recovery with Minimal Down Time

Medicat has also taken geographic redundancy to the next level with a pre-built Warm Standby disaster recovery site at a comparable TierPoint facility in Chicago, Illinois. This facility, also designed to a 2N standard, asynchronously replicates and archives client data from the Research Triangle Park facility.

Should a catastrophic, non-recoverable event disable the TierPoint facility in Research Triangle Park (e.g., direct hit by a large tornado), Medicat would bring up the Warm Standby site in Chicago, and users could resume their work with only a brief interruption. In this case, Medicat has a Recovery Time Objective (time to resume use of the system) of 3 hours or less and a Recovery Point Objective (time over which data would be lost) of < 1 hour.

College Health EHR with Type 2 SOC 2

To ensure storage, handling, and protection of clients’ electronic Patient Health Information (ePHI) meets and exceeds all government and industry standards, Medicat has made significant investments in its infrastructure and security framework. To substantiate that investment, Medicat has gone through the same third-party audit process as leading data centers in the country and has received Type 1 SOC 2 and Type 2 SOC 2 Examinations.

A company that has performed Type 2 SOC 2 Examination has proven its system is designed to keep clients’ sensitive data secure. When it comes to the cloud and related IT services, such performance and reliability are essential and required more often by regulators, examiners, and auditors.

Frequently Asked Questions About Security

Is Medicat HIPAA compliant, and how does it handle FERPA for student health records?

Yes, Medicat is built to support HIPAA compliance, and we enter into a Business Associate Agreement (BAA) with each institution.

For student records, we recognize that campus health data can fall under HIPAA, FERPA, or both, depending on how your institution is organized. Medicat is designed to keep treatment records appropriately separated from education records so your team can meet its obligations under the framework that applies to your organization.

Who owns the data, and what happens to our records if we switch EHR systems?

Your institution owns its data. Medicat is the custodian, not the owner. If you move to another system, we provide a full export of your records and follow a defined data return-and-deletion process at the end of the engagement.

Is Medicat SOC 2 certified?

Yes, Medicat holds SOC 2 Type II certification — a continuous, multi-month assessment of our security controls spanning security, availability, processing integrity, confidentiality, and privacy — and was the first college health EHR to achieve Type II.

We can provide our SOC 2 report under NDA and complete standard security questionnaires to support your security/IT review, including HECVAT.

How does Medicat keep sensitive student data secure in the cloud?

Health and counseling data is hosted in a secure cloud environment and protected by encryption in transit and at rest.

Plus, access to student records is governed by role-based permissions and audit logging, so staff see only what their role allows. For example, counseling records can be restricted separately from student health records, so only authorized clinicians can view each type of record. These permission-based controls are configured by your clinic’s administrators.

Does Medicat support single sign-on (SSO) with our campus identity provider?

Medicat supports single sign-on so users authenticate through your existing campus tool(s). Medicat can integrate with multiple commonly-used SSO protocols, such as Azure and Shibboleth.

This approach keeps provisioning and de-provisioning under your control and lets users inherit your MFA policies.

Does Medicat integrate with our Student Information System (SIS)?

Yes, Medicat integrates with multiple campus Student Information Systems (like Banner, PeopleSoft and Workday) to automate regular imports and exports of demographics and enrollment data, configured to match your institution’s data feed.

Is there an API for pulling reporting data into our own dashboards?

Medicat’s EHR platform includes robust built-in reporting. However, data can be extracted for use in your own dashboards or data warehouse. If you have a specific Business Intelligence tool in mind, our team can confirm the best approach.

How does Medicat connect to labs, pharmacy, insurance, and billing systems?

Medicat securely connects to a broad set of clinical and administrative systems:

– Labs: bi-directional interfaces with lab information systems and reference labs, plus radiology order and results processing.
– Pharmacy: bi-directional pharmacy interfaces and ePrescribing, including controlled substances, formularies, and interaction checking, through the Dr. First/Rcopia solution.
– Insurance and billing: electronic claims submitted through the Waystar and Availity clearinghouses.