Try it free in the sandbox · first FHIR call in 5 minutesFree · 30 synthetic patients · no card

Evaluating a medical data platform: questions for hospitals

The questions a hospital should ask a medical data platform vendor, answered for Anpheros from its security documentation: residency, isolation, audit, agreements, certifications and what is not in place yet.

A hospital or clinic choosing a platform for patient data should get written answers to a fixed set of questions: where the data is, who can reach it, what is logged, what happens in an incident, which agreements apply and what is not yet in place. Below are those questions, answered for Anpheros Platform from its own security documentation. Where something is not in place, it says so.

The questions and the answers

Question	Answer for Anpheros Platform
Where is the data stored?	In the European Union: the service and databases in Google Cloud `europe-west4` (Netherlands), the webhook queue in `europe-west3` (Frankfurt), the access-log export in the BigQuery EU location. Data is in the EU by default. A US data region and a HIPAA business associate agreement are available on request for production customers; production for US patient data starts only after the BAA is signed.
How are documents protected?	Stored in an EU bucket, encrypted with a customer-managed key. Originals are immutable after finalisation, with SHA-256 checksum and size recorded.
Can one customer see another's patients?	No. Every key belongs to one project that sees only the patients it created. Each project gets its own identifier for the same person, so ids cannot be correlated. A record you cannot reach answers `404`, not `403`.
Is test data separated from real data?	Yes. Sandbox and production are separate databases; a sandbox key physically cannot reach real patients.
Who decides who reads a record?	The patient, per organisation, per resource type and action, for 30, 90, 180 or 365 days. Revocation takes effect on the next request.
What is logged?	Every write produces a provenance record (who, for which organisation, from which system). Every read is logged, including reads made with your own key, and the patient can see the log. The log is hash-chained and exported append-only.
How are credentials handled?	API keys are shown once and stored only as a hash. OAuth 2.1 with mandatory PKCE; access tokens last 30 minutes; refresh tokens rotate and a reused one revokes the whole chain. MFA or SSO is required for organisations with a production project.
What about backups and recovery?	Daily backups and point-in-time recovery, with a restore drill every 90 days and the times recorded.
What happens in a breach?	Under the business associate agreement for US clinics, the covered entity is notified within 5 business days. A written incident response policy is in place.
Which agreements are available?	A data processing agreement for every production customer; a business associate agreement for US clinics, on request.
Which certifications does it hold?	None yet. Anpheros is not certified against SOC 2 or HITRUST. A SOC 2 Type II audit is planned when a hospital customer requires it. Conformance of the SMART standalone launch passes the Inferno test group.
Is there an availability guarantee?	No contractual SLA during the private beta. The service runs in a single zone without automatic failover, so a zone outage is a full outage.

What this means in practice

Strong: consent per organisation, an audit the patient can read, strict isolation between customers and an EU region. These are design properties of the platform, not options.

Not yet there: a contractual SLA, multi-zone failover and an independent certification. A hospital with those as hard requirements should plan a pilot with synthetic data and revisit as the platform matures. For the first production use, a department or a single result type is a reasonable scope.

To ask of any vendor, including us: the sub-processor list, the incident history, how deletion requests are handled and how an exit works. At Anpheros a deleted patient stops counting from the next day, and a cancelled production project stays readable for 30 days so the data can be exported before it is deleted under the data processing agreement.

How to run the evaluation

Read the security, privacy and data residency guide and the known limitations, and compare them with your own checklist.
Build a pilot in the sandbox with synthetic patients; no data protection review is needed for synthetic data.
Ask for the data processing agreement, before any real record is loaded. US clinics should ask for the business associate agreement and the US region, which are available on request.
Check consent and revocation yourself: approve access, read, revoke and read again.

Frequently asked questions

Is Anpheros GDPR compliant?

Patient data is stored in the EU, access is based on the patient's explicit consent with a stated purpose and period, every read is logged for the patient, and a data processing agreement is signed before production. For the legal analysis in your own organisation, see GDPR and health data for developers.

Is Anpheros HIPAA compliant?

For a US clinic, Anpheros acts as a business associate, with the Security Rule safeguards mapped in the security guide. A business associate agreement and a US data region are available on request for production customers; production for US patient data starts only after the BAA is signed, and data is in the EU by default. Anpheros is not certified by a third party.

Is Anpheros certified for ISO 27001, SOC 2 or HITRUST?

Not at present. The security documentation says so openly, and a SOC 2 Type II audit is planned when a hospital customer requires it.

Can we run a pilot without real patient data?

Yes. The sandbox has the same API as production and holds synthetic patients only. Beta partners also start with synthetic data in a production project for an agreed period before loading real records.

What if we want to leave?

You can export what your organisation wrote. After cancellation, production stays readable for 30 days for export and is then deleted as the data processing agreement states.