Trust · IT and security review
Everything your IT and security teams will ask
How Aurifex connects to Epic, where data lives, the controls we can evidence today, what a pilot asks of your IT team and what's in the security packet. Effort figures are estimates, confirmed at kickoff.
Vendor risk facts
| Question | Answer |
|---|---|
| Subprocessors | Two: AWS (hosting, US regions) and Azure OpenAI Service (model API, under BAA, zero data retention). You get 30 days' notice of any change |
| Recovery targets | Recovery time and recovery point targets are set in the pilot agreement. Backup restores are tested quarterly |
| Penetration test | Third-party test, most recent Q3 2026, repeated annually and before each new hospital goes live; high and critical findings are tracked to closure, and the summary is shared under NDA. Continuous dependency and infrastructure scanning is in place today |
| Epic access | Your Epic analyst registers the backend app through your own app review; typically 2 to 6 weeks, depending on your review process |
| Integration | Runs inside your Epic workflow through standard interfaces and your own Epic build; not an app hosted by Epic |
| Downtime | Epic keeps working without Aurifex. You're notified within an hour of an outage |
Epic integration
What this is and isn't. Aurifex runs inside your Epic workflow through standard interfaces and your own Epic build. It isn't an app hosted by Epic, and we don't claim any Epic partnership or listing.
| Item | How it works |
|---|---|
| App registration | A backend (system-to-system) FHIR app, registered and approved through your Epic app review process, using OAuth 2.0 client credentials with a signed JWT |
| FHIR scopes requested | Read-only: system/Patient.read, Encounter.read, Condition.read, Observation.read, MedicationRequest.read, Procedure.read, ServiceRequest.read, Coverage.read and DocumentReference.read. Clinical notes are read as DocumentReference |
| HL7 v2 ADT events | A01 admit, A02 transfer, A03 discharge, A04 register and A08 update, routed from your interface engine |
| History load | A one-time pull of about 12 months of encounters through the same backend app, to fit and validate the discharge model, approved by your Epic analyst and privacy officer |
| Where results appear | Columns in your case-management worklist and a Discharge Planning activity view, built by your Epic analyst from data Aurifex returns, plus a review worklist for sampled drafts |
| Write-back | Only after a named person approves. The PM&R consult is a pended order written through the order interface your analyst configures, and the physician signs it. The case manager sends or files the packet |
| Sign-in | Single sign-on through your identity provider with SAML 2.0 or OpenID Connect, with roles mapped to your existing ones |
| Environments | Built and tested in your non-production environment, then silent mode on live data before go-live |
| Epic upgrades | We retest in your non-production environment before each Epic upgrade and follow your change freezes |
If Aurifex is down, Epic and your worklists keep working without it. Every Aurifex column shows a last-updated time. If a feed goes stale, a banner appears and the Aurifex columns go blank rather than show old data.
Hosting and data
| Item | Detail |
|---|---|
| Cloud provider and model service | A major US cloud provider and a HIPAA-eligible language-model service, both under BAAs. Named in the security packet, before a BAA is signed |
| Region | US regions only |
| Tenancy | A separate database for each hospital, so your patients' data is kept apart from every other customer's |
| Encryption | TLS 1.2 or higher in transit and AES-256 at rest, with keys managed per tenant in the cloud provider's key service |
| What the language model sees | Only the note excerpts a draft needs, with names, MRNs and member IDs replaced by tokens; Aurifex adds identifiers back after drafting. Zero data retention under the provider's BAA, including no abuse-monitoring retention |
| Your model | The discharge model is fit on your hospital's history and never used for another hospital. At exit it's deleted with your data, unless you ask us to hand it over |
| Backups | Encrypted, in US regions, and rolled off within 35 days of a deletion |
| Exit | Patient data returned or destroyed within 30 days of the end of the agreement, with written confirmation |
Retention defaults for each kind of data are listed on the Trust page.
Controls and operations
In place today
- Security policies. Written policies for access control, change management and incident response.
- Access. Single sign-on and multi-factor authentication for our staff, separate service identities and least privilege.
- Audit trail. Every read, draft, edit, approval and rejection is logged and available to your compliance team.
- Vulnerabilities. Dependencies and infrastructure scanned continuously, with critical issues fixed first.
- Security questionnaire. Completed in SIG Lite and CAIQ formats; it's part of the security packet.
Before your go-live
- Penetration test. Most recent Q3 2026; repeated every year and before each new hospital goes live, with the summary shared under NDA.
- Restore test. A backup restore of your tenant, repeated quarterly.
- SOC 2 audit. Not yet. Type I audit targeted for Q2 2027; Type II to follow.
Incidents, availability and support
- Incidents. We tell you about a suspected breach of your patients' data within 72 hours of discovery.
- Availability. No uptime SLA during a pilot. Outage notice within an hour. The availability target, recovery targets and support response times by severity are set in the pilot agreement.
- Support. A direct line to us during a pilot, business-hours support and an escalation path for anything affecting clinical work.
IT effort for a pilot
About 100 hours of IT time over 20 weeks, about 70 of them in the first six weeks. Estimated for one or two pilot units, confirmed at kickoff.
| Role | Weeks 0–6 | Weeks 6–20 | What they do |
|---|---|---|---|
| Epic integration analyst | About 4 hours a week | About 1 hour a week | App approval, FHIR access, history load, testing |
| Interface engine analyst | About 2 hours a week | As needed | Route and test the ADT feed |
| Epic Care Management analyst | About 4 hours a week | About 1 hour a week | Worklist columns, the Discharge Planning view and the review worklist |
| Identity and access | About 4 hours in total | As needed | Single sign-on and role mapping |
| Information security and privacy | About 6 hours in total | As needed | Questionnaire, architecture review, BAA |
No interface engine or Epic build outside your non-production environment is needed before silent mode. The Care Management analyst hours include the barrier routing and the pended-order build.
The security packet
Ask for it at any point, before or after a demo. It includes:
- The completed security questionnaire (SIG Lite and CAIQ)
- An architecture and data-flow diagram, with the named cloud provider and model service
- The data handling and retention summary
- Our draft business associate agreement and the subprocessor list
- The penetration test summary and incident response overview
- The AI model descriptions for your governance committee
Request the security packet Print the one-page summary
Epic is a trademark of Epic Systems Corporation. Aurifex is not affiliated with or endorsed by Epic.
See Aurifex on your own discharge workflow
We'll walk through your worklist, a drafted referral and how a pilot would be measured on your units.