Yes! Caredove has implemented a comprehensive Privacy and Security program that ensures the information of our customers and patients is kept private and secure. This includes Personal Information (PI) and Personal Health Information (PHI) lifecycle management, physical, technical and process safeguards.

Yes! In Canada the Personal Information Protection and Electronic Documents Act (PIPEDA) establishes laws that regulate the collection, use and disclosure of personal information. Caredove adheres to the 10 principles that businesses must follow, and these are detailed on our Privacy Policy page.

Yes! U.S. customers need Caredove to be HIPAA compliant. Caredove uses a fully automated managed services platform provided by an AWS Healthcare Competency Partner that provides coverage for over 200 HITRUST Common Security Framework controls mapped directly to the HIPAA regulations. See more details on our Caredove & HIPAA page. 

Caredove is hosted wherever you need it to be! Caredove uses Amazon Web Services (AWS) in the Canada Region for all Canadian customers. We have access to all AWS locations worldwide so for our international customers we can store data in any region required for compliance. We only use AWS Healthcare certified processes. For Canada see AWS in Canada.  

To prevent malicious software including ransomware, Caredove has adopted a defense in depth approach, with many layers of protection that would prevent exposure or loss of data. ‍

These measures include but are not limited to employee education, encryption, and acceptable use policies and procedures. Caredove’s systems are protected with: anti-malware scanning to stop software from attacking a server; network security including intrusion prevention which stops vulnerabilities from being exploited and the resulting potential installation of malicious software (including ransomware); system security, including integrity monitoring which can provide visibility of system changes that represent malicious software activity; Web Reputation, which blocks outbound communication to known bad domains.

Learn more about how Caredove protects client data in our Data Security Policy.

We have developed a comprehensive approach to privacy and security and have created the Caredove Trust Report, an online resource that contains everything you need to know about Caredove for your PIA. You can find more information about this in our article "Ensuring Patient Privacy in the Digital Age: How Caredove Empowers Healthcare Networks to Conduct Thorough Impact Assessments"

Caredove’s Fax-to-Referral feature uses AI to read uploaded documents, such as faxed referrals, and convert them into electronic referrals. AI is only used when an organization has turned on Fax-to-Referral and uses it.

Caredove stores Canadian customers’ documents and patient information in Canadian data centres. To read a document, Fax-to-Referral uses AI services inside our cloud provider’s secure system, and some of this processing may take place in the United States. The information is encrypted, travels only over our cloud provider’s private network. There are limited exceptions, such as where our cloud provider is required to act on content that may put a child’s safety at risk, or to meet other legal obligations.

Caredove may keep the extracted information and user corrections, stored in Canada, to check and improve accuracy. Your information is not used to train AI models, and the companies that develop those models never receive or keep your data.

Caredove maintains a documented policy that guides our response to suspected or confirmed security and privacy incidents.

Our response includes investigating and containing the incident, assessing potential impacts on personal information, taking corrective action, and notifying affected customers as appropriate.

We work with affected organizations to support their obligations under applicable privacy legislation.

You can connect Caredove service requests and search sites to any website via standard web-links or Caredove's embed widget. The embed widget uses standard secure iFrame functionality which are authorized by Caredove for approved domains. ‍

Caredove customers can purchase a license for our WebBuilder content management system with specialized features that allow them to publish service information easily online. They can also bring their own website and their own hosting on platforms such as WordPress, Wix, Squarespace or Drupal. In all cases, the same approach to launching a Caredove service request is used. The Caredove referral management system is sandboxed to be entirely separate from the embedding, or referring, website. ‍

This means that when anyone searches or requests a service from any website, it launches our Referral Management application as a separate application which is subject to all of our stringent security protocols. ‍

No PHI information from the integrating website is provided to Caredove via an embedded Caredove widget. The only information shared with an embedded widget is widget layout, size, etc. All collection and handling of PHI is done with the launched Caredove application. Caredove’s security program documentation can be found above.‍

Caredove’s WebBuilder is an optional add-on feature to Caredove, that is used to build marketing-style websites. Its underlying code, hosting and management is completely separate from Caredove. It is connected to Caredove with the same methods as any other external website, only via standard weblinks or iFrames (for authorized domains). Our WebBuilder is a customization built on the Duda web platform that allows for easy integration with Caredove via custom widgets and templates. Duda is a globally reputable and leading company in web building. You can view their security measures here.  

Links to our legal agreements and Privacy and Security Program can be found at the top of this page. If you wish to speak with someone at Caredove, please email us or call us at 416-655-7997, or toll free in North America at 1-833-567-3683.