Choosing Safe Clinical Software: 10 Questions to Ask Your Provider

More and more psychologists migrate their clinical records to digital platforms. It is logical: a well implemented clinical software is safer than a notebook, more efficient than an Excel spreadsheet and more accessible than a folder archiver.

But not all software is the same. Some encrypt your data; others store it in plain text. Some ensure that no one else accesses information; others use it to train artificial intelligence models. The difference between a secure software and one that is not can be the difference between complying with the law and facing a demand.

In this article we give you a clear framework to evaluate any platform before entrusting you with the most sensitive data of your patients.

Why does software security matter?

When you use clinical software, you're trusting him:

• Names, IDs and contact details of your patients
• Diagnosis and treatment plans
• Contents of therapeutic sessions
• Medication and health history
• Information on suicidal ideation, abuse, addictions

They are the most sensitive data that exist. Law 25.326 makes you responsible for the security of that data. Art. 25 specifically regulates the provision of computer services: the provider cannot use the data for a purpose other than the contracted one, nor assign them to third parties. And Art. 11.4 states that assignor and transferee respond solidarly — that is, if your software provider has a breach, you are also responsible.

The 10 questions to ask the provider

Before you entrust your data to any platform, ask them these questions. If they cannot answer them or become evasive, it is a warning signal.

1. Are the data encrypted?

What exactly to ask?

• Are the data encrypted at rest (at rest)?
• Are the data encrypted in transit (in transit)?
• What encryption algorithm do they use?
• Who has the encryption keys?

What answer to expect?

Red flag: If they call you "we use HTTPS" as if it were enough. HTTPS is the minimum for any website — your bank, your social network, your online store. For mental health data, you need much more.

2. Where are the data stored?

What to ask?

• What country are the servers in?
• What cloud provider do you use (AWS, Google Cloud, Azure, another)?
• Can the data be transferred to other countries?

Why Does It Matter?

Knowing where your data is allows you to evaluate the security guarantees and contractual obligations of the provider. It is not the same a datacenter with international certifications as a server without audits.

The ideal:

• Recognized cloud provider (AWS, Google Cloud, Azure) with security certifications
• Data encryption at rest and in transit
• Clear policy on where the data are and if they move

3. Who can access my clinical data?

What to ask?

• Can the support team view the contents of the medical records?
• Do developers have access to production data?
• Are there records (logs) of who accesses what?

What answer to expect?

4. Are my data used to train AI models?

This question is becoming increasingly relevant. Many software incorporates AI functions (transcription, summary of sessions, suggestions).

What to ask?

• Are my patients' clinical data used to train or improve AI models?
• Are data shared with third parties (OpenAI, Google, etc.) for processing?
• Can I choose not to use AI functions without losing functionality?

The only acceptable answer is NO. Your clinical data should not be used to train AI models. Art. 4.3 of the 25.326 Law prohibits using data for purposes other than or incompatible with those that motivated its acquisition, and Art. 25 states that the computer service provider cannot apply the data for a purpose other than the contracted one.

5. What happens to my data if I cancel the subscription?

What to ask?

• Can I export all my data before I cancel?
• In what format are they exported? (PDF, CSV, other)
• How long do you keep my data after you cancel?
• Are they definitely eliminated after a period?

Why Does It Matter?

If a software closes, changes policies or simply stops agreeing, you need to be able to take your data. Remember that the 26.529 Act requires you to keep medical records for 10 years. If you cannot export, you have a legal problem.

The ideal:

• Complete export in standard format (PDF at least)
• Grace period after cancellation (30-90 days)
• Final elimination after grace period, with confirmation

Red flag: Software that does not allow you to export data or charges you extra for doing so.

6. Do they have backups? How often?

What to ask?

• How often are backups made?
• Are backups encrypted, too?
• Where are backups stored? (different location than main data?)
• How long does it take to restore data if there is a problem?

The ideal:

• Daily backups at least
• Encrypted Backups
• Storage at different geographical location
• RPO (Recovery Point Objective) maximum 24 hours
• RTO (Recovery Time Objective) for up to a few hours

7. Do they comply with Argentine data protection legislation?

What to ask?

• Do they comply with the 25.326 Law?
• Are they registered to the AAIP?
• Do you have a Data Protection Delegate?
• Do they perform privacy impact assessments?

Context: Many clinical software are of foreign origin (USA, Spain) and are not familiar with Argentine legislation. If the provider does not know the 25.326 Law or the 26.529 Law, that is a problem.

8. What security measures do you have in place?

What to ask?

• Do you offer two-step verification (2FA)?
• Do sessions automatically expire due to inactivity?
• Is there log-in log-in?
• Do they perform periodic security audits?
• Do they do penetration tests?

Minimum Checklist:

9. What happens in case of a security breach?

What to ask?

• Do you have an incident response plan?
• How long do they notify me if there's a breach?
• What information do you give me about the extent of the incident?
• Have you had security breaches before?

The ideal:

• Notification in less than 72 hours
• Detailed information on which data were affected
• Action plan to mitigate harm
• Total transparency (if you hide incidents, it's a huge red flag)

10. Do you have clear terms of service and privacy policy?

What to verify?

• Are the terms in Spanish and are they understandable?
• Does the privacy policy detail what data they collect and for what?
• Are there abusive clauses? (e.g. "we reserve the right to use your data for any purpose")
• Can you change the terms without notice?

Red flags in terms of service:

• "You grant us an irrevocable license over your data"
• "We can share data with third parties to improve our services"
• "We reserve the right to modify these terms at any time"
• Total absence of mention of the Law 25.326

Comparative table: types of software

Warning signs

Distrust a clinical software if:

• No privacy policy or generic/copied
• Can't explain how it encrypts the data or uses vague terms ("we use the latest technology")
• The support team can read your clinical notes "to help you better"
• Does not allow export of data or charges for doing so
• Does not offer 2FA (two-step verification)
• Service terms give you rights to your data
• They are not aware of Law 25.326 or the Law 26.529
• Use your data to train AI or share it with third parties
• Never had a security audit
• They are evasive when you ask about safety

Positive signs

Trust more in clinical software if:

• Has end to end encryption documented
• Publishes its security policy and is specific
• It has recognized certifications (SOC 2, ISO 27001, HIPAA)
• Offers 2FA and actively recommends it
• Allows full export of data in standard format
• It has policy not to train AI with your data explicit
• Makes security audits and communicates them
• Meets and complies with the Argentine legislation
• It is transparent about past incidents (if any)
• Has clear documentation about where the data are and who accesses

How Brauni answers these 10 questions

Summary