Short answer Yes
Moonshot EHR is built and operated to HIPAA requirements and signs a Business Associate Agreement with every clinic before any patient data is entered; the BAA is a step in signup, and PHI routes return an error until it is executed. In the product that means two-factor authentication for every user, a tamper-evident audit log, a 30-minute idle timeout for staff, per-chart access restriction, and a patient data export. HIPAA has no government certification, so no vendor can honestly claim one.
How it works in Moonshot
- Two factors are required for every staff account from the first dashboard visit: passkey, authenticator app or SMS code.
- The audit log is a per-clinic hash chain, so an edited or deleted entry is detectable, and it is archived.
- Staff sessions end after 30 minutes idle. Platform administrators have their own shorter limits and an absolute daily expiry.
- Restricted charts, role permissions and a disclosure log for faxes and releases cover the minimum-necessary side.
Limits, stated plainly
- Moonshot does not hold a SOC 2 report today. If a buyer requires one, say so early and we will tell you where that stands.
- Compliance is shared: the clinic's own policies, training, device security and texting content are the clinic's responsibility.
- Texting is a HIPAA-permitted channel when used for the minimum necessary; the content of what staff send is the clinic's call.
Related
Questions people ask next
Where is the data hosted?
In AWS in the United States, with the clinic's data isolated per tenant.
Do you sign a BAA with every clinic?
Yes. It is signed inside the signup wizard before the first chart exists.
Can we export our data if we leave?
Yes. Patient data export exists for patients, and chart packets, documents and CSVs are available to the clinic.
Checked against the product on October 18, 2026. If the product changes, this page changes with it; the changelog lists what shipped and when.