Audit controls
You should be able to see who viewed or changed a record, when, and what the value was before and after. Look for a log that cannot be edited or deleted.
Automatic sign-out
Phones get left on counters. Sessions should end automatically after a period of inactivity.
Private document storage
Documents should never sit at a public link. Each view should use a short-lived link and be recorded.
Minimum necessary access
New staff should need approval before seeing anything. Roles and per-person permissions should limit who can edit, delete or export.
Notifications without PHI
Push and email alerts are convenient but easy to over-share. Alerts should say only that something needs attention and send the user to sign in.
Data isolation
If a vendor serves many facilities, each facility's data must be separated at the database level, not just hidden in the interface.
How ALFIntake handles it
ALFIntake includes an append-only audit trail, 15-minute idle sign-out, private storage with 5-minute links, admin approval for new staff, per-person permissions, PHI-free alerts and database-level isolation between facilities. Your own HIPAA program — policies, training and agreements — remains your responsibility.