Fictional data only
Every patient, provider, document and database in every product is invented for teaching. We never hold real health information.
Security & privacy
Protected by design, in every product
Health information professionals are trusted with the most sensitive data there is. ChartLab, CodeLab, SQLLab, BedsideLab, MotionSensesLab and MindMotionLab are built to the same standard they teach: careful access control, private colleges, protected assessments and no real patient data, ever.
- One secure account
- Answer keys stay private
- No real patient data
Our principles
Three commitments behind every feature
Access by role
Administrators, faculty and students each see only what their role allows. The server checks it on every request.
Colleges kept apart
Every record, activity and submission belongs to one college. No college can see another’s people or work.
Controls in place
How we keep your program safe
A plain-language summary of the protections. Everything applies to every product unless it is labelled.
Accounts & sign-in
- One account per person for every product
- Passwords stored only as salted scrypt hashes, never in readable form
- New accounts start with a temporary password that must be changed at first sign-in
- Repeated failed sign-ins are slowed down automatically
- CodeLab, SQLLab, BedsideLab, MotionSensesLab and MindMotionLab class codes can have an end date and a use limit, and can be switched off
Sessions
- Session cookies that page scripts cannot read and other sites cannot send
- Secure cookies over HTTPS
- Sessions expire automatically after at most seven days
- Signing out ends the session on the server, in every product
Academic integrity
- Answer keys are removed before anything reaches a student
- Key queries never reach students: they see only the questions SQLLab
- Item keys, rationales and model answers reach students only once their work is graded, or in practice mode BedsideLab
- Rubric terms never reach students; after grading they see only the key points, and submitted answers are locked MotionSensesLab
- Students see only their own work and the assignments for their section
- Team files (CodeLab, SQLLab, BedsideLab, MotionSensesLab and MindMotionLab) are shared only with members of that team
- Signed clinical notes cannot be changed; corrections are added as addenda ChartLab
Web protection
- A strict content security policy and no embedding in other sites
- Every change request must come from the site itself, blocking cross-site requests
- Uploads are limited in size and to approved document types
- In CodeLab, SQLLab, BedsideLab, MotionSensesLab and MindMotionLab, submitted work is accepted only as .docx or .pdf
Student SQL
- Student SQL runs in a separate process and never reaches the site database
- Every Workbench run uses a fresh in-memory copy of the database, and nothing is saved SQLLab
- Statements that could reach other files (ATTACH, extensions, most PRAGMAs) are refused SQLLab
- A query that runs too long is stopped after 8 seconds SQLLab
- The data analysis console accepts read-only queries only, with time, memory and row limits ChartLab
Your college’s data
- Each product keeps its own content and work; none shows another’s
- Saved records are checked on the server before they are stored
- If a plan ends, that product becomes read-only; nothing is deleted
- Platform staff manage colleges but never see students or their work
Privacy and compliance in the curriculum
We don’t just protect privacy. We teach it.
Labs and activities on confidentiality, disclosure, coding compliance and data quality: responsibilities HIM graduates carry into every job.
ChartLabLab 19
EHR Privacy, Security and Audit Logs
Investigate unauthorized access in an audit log and fix the access controls.
ChartLabLab 29
Release of Information
Decide what may be released, to whom, and what must be recorded.
ChartLabLab 24
Consents and Advance Directives
Document consents and spot incomplete forms.
ChartLabLab 30
Patient Portal Secure Messaging
Reply professionally while protecting the patient’s privacy.
CodeLabActivity
Coding Validation Audit
Audit ten coded encounters, classify each error and calculate the accuracy rate.
CodeLabActivity
Clinical Documentation Improvement and Provider Queries
Find where documentation falls short and write compliant, non-leading queries.
SQLLabLab 25
Views, Indexes and Safe Bulk Updates
Build a de-identified research view and run a bulk update safely.
SQLLabLab 26
Data Quality Audit of an Interface Import Batch
Find duplicates, invalid codes and orphan records before data enters the EHR.
BedsideLabCase 29
Recognizing Intimate Partner Violence in Pregnancy
Create a private space, ask, document and plan for the patient’s safety.
BedsideLabCase 31
Early Warning Scores, SBAR and the Chain of Command
Recognize deterioration, report it clearly and escalate when the answer is not safe.
Shared responsibility
What we ask of colleges
Security works best together. A few simple practices keep your college’s space safe.
- Share temporary passwords with each person privately
- Give class codes an end date, and switch off any that are shared too widely
- Remove or deactivate accounts when people leave the program
- Never enter real patient information in any product, including your own SQL databases
- Report anything unexpected to your college administrator
Questions about security?
Your college administrator can answer questions about your college’s setup.