Security White Paper

Ikonopedia is a cloud-based web application. Ikonopedia follows HIPAA guidelines and industry best practices to secure data, both from accidental loss and from malicious attack and/or theft.

All personally identifiable information for all patients stored in Ikonopedia databases is encrypted using Advanced Encryption Standard (AES) algorithm. This includes patient name, address, date of birth, medical record number (MRN), the text of the patient’s report, and the name and contact information of the referring physician.

To secure access to the Ikonopedia application all passwords for all Ikonopedia user accounts are salted and hashed using SHA-512 algorithm. Ikonopedia Advanced Security can aslo authenticate to your own Identity Provider (IdP) and enforce multi-factor authentication.

To further secure the application and to minimize either accidental or malicious data corruption each Ikonopedia customer has its own database. An attack on or accident in one customer’s database would not affect other customers.

Ikonopedia servers are Linux-based and are professionally managed by a hosting company which continuously installs security updates and monitors for possible attacks or intrusions.

All communication, without exception, that takes place between the hospital or the clinic and Ikonopedia web server over the public internet is conducted exclusively in standard Hypertext Transfer Protocol (HTTP) and is encrypted using current industry standard Transport Layer Security (TLS) technology supported by every web browser.

Communication that takes place behind the hospital’s or clinic’s firewall on the local network between the Ikonopedia app and hospital’s or clinic’s other systems is not encrypted by default. If required, encryption can be introduced by setting up a virtual private network (VPN) within the hospital’s or clinic’s local network. This can be done at the discretion of the hospital or clinic and has no impact on Ikonopedia app’s performance or functionality.

What are EQUIP Requirements?

To implement EQUIP, the FDA will add the following questions to the quality assurance components of its facility inspections to assess compliance with image quality requirements:

1. Does the facility have procedures for corrective action (CA) when clinical images are of poor quality?
2. Does the facility have procedures to ensure that clinical images continue to comply with the clinical image quality standards established by its accreditation body?
3. Does the facility have a procedure for Lead Interpreting Physician (LIP) oversight of QA/QC records and corrective actions?

Ikonopedia helps you meet EQUIP requirements with a set of processes and reports that are naturally inherent in the design of our system.

Flagging for Corrective Action

Radiologists can flag images for corrective action using our built-in technical-repeat feature that is part of our screening modality. The radiologist can specify as little or as much detail as needed when flagging images for corrective action.

Automated EQUIP Reviews

Ikonopedia automatically initiates periodic FDA-mandated image quality-reviews, for both interpreting physicians and radiology technologists.

The reviewer can grade an auto-generated sample of exams, document deficiencies and indicate required corrective action as indicated.

Each exam is graded on the eight standard image quality measures. Grading criteria can be customized as needed and the reviewer’s feedback is included in quality-review reports.

Ongoing EQUIP Oversight

Ongoing oversight of QA/QC records and corrective action is managed through Ikonopedia Analytics. A variety of reports specifically designed to address the EQUIP initiative are available. User access to view EQUIP reports is fully configurable.

Notice of Privacy (HIPAA)

Effective date of notice: February 4, 2013

Purpose of this Notice

Ikonopedia respects the privacy of protected health information and understands the importance of keeping this information confidential and secure. This Notice describes how we protect the confidentiality of the protected health information we receive.

Health Insurance Portability and Accountability Act of 1996 (HIPAA)

Ikonopedia maintains a comprehensive system to ensure compliance with applicable provisions of the Health Insurance Portability and Accountability Act of 1996 (HIPAA). Since our goal is to provide the highest level of service to our customers and business partners, we want you to know how Ikonopedia complies with the HIPAA directives. Our HIPAA Privacy Policy contains procedures addressing the protection, use and disclosure of protected health information (“PHI”), accounting of disclosures, access by individuals and third parties to PHI, protection of PHI by contractors, business associate agreements and training of employees.

How We Protect Personal Information

We treat personal information securely and confidentially. We limit access to personal information to only those persons who need to know that information to provide support services to our customers. These persons are trained on the importance of safeguarding this information and must comply with our procedures and applicable laws. We employ strict physical, electronic and procedural security standards (fully encrypted PHI) to protect personal information and maintain internal procedures to promote the integrity and accuracy of that information.

Disclosure of Personal Information

We may use or disclose protected health information to the Food and Drug Administration (“FDA”) in connection with the reporting of adverse events, product defects or problems, product tracking or for other purposes as required by the FDA. We may use or disclose de-identified protected health information during the course of clinical research activities. We may also disclose personal information as required by law.

Individual Rights to Access and Correct Personal Information

We have procedures in place for individuals to have access to protected health information, and procedures in place to ensure the integrity of our information and for the timely correction of incorrect information. You may contact our HIPAA privacy officer (listed below) to access to your protected health information.

Filing a Complaint

If you feel that the privacy of your personal health information has not been managed securely, please contact our HIPAA privacy officer at the email below.

Further Information

Ikonopedia may find it necessary to revise and update its HIPAA Privacy Policy from time to time as changes to the privacy regulations emerge and will communicate any such changes to our customers and business partners.

Ikonopedia HIPAA Privacy Officer

Scott Stoll
admin@ikonopedia.com