Security & privacy

Built for patient data.

Referrals carry protected health information. Direct Axess is designed around HIPAA — every account, every file, every view.

Where a referral goes — and where it doesn’t.

SenderReferring providerSigns in with 2-step verification

Direct Axess

ReceiverSpecialist practiceOnly staff you grant access

Email & push: “A referral was updated.” Notification emails and push messages never contain patient information — details stay behind the login.

Two-step sign-in, required
Every user — provider, staff or practice — signs in with an authenticator app. No exceptions, no opt-out.
Practice-level isolation
Each practice’s data is walled off inside the database itself — not just hidden in the interface.
Scanned before opened
Every attachment is virus-checked. Until it comes back clean, nobody can open it.
Permanent audit record
Every status change and every look at patient data is written to a record that cannot be edited afterwards.
Seats, not shared logins
Staff act under their own names, so the audit trail always shows who really did what.
Healthcare-grade hosting
Runs on AWS infrastructure covered by a business associate agreement.

Every provider and practice accepts our BAA when they join.