How Anesloop handles your PHI, your audit trail, and your substance log.

01 · Encryption in transit

Encryption in transit.

Everything that crosses the wire between Anesloop and the systems it touches goes out under TLS 1.3 with modern cipher suites — no exceptions, no fallback to TLS 1.2 or 1.1.

Your AIMS feed, your EHR connection, and the Anesloop cloud all sit behind that same transport envelope, which is why a single BAA can cover all three. The Postgres cluster you deploy into runs TLS between application servers and the database, so a packet capture on either side does not give an attacker anything they can read.

• TLS 1.3 only — 1.2 and 1.1 are disabled at the edge.
• Modern AEAD cipher suites negotiated per session; no static keys, no shared certs across environments.
• Mutual checks: app-to-AIMS feed, app-to-EHR feed, and app-to-Postgres wire traffic all encrypted in transit.

02 · Role-based access, provisioned by your team

Role-based access, provisioned by your team.

Every account has one role. Better Auth's admin plugin gives us a thin account model — a `user` for clinicians and front-desk staff, an `admin` for the people at your ASC who provision and de-provision everyone else. Default role is `user`; no account is born into a privileged tier.

Admins on your side create and revoke accounts. We do not ship with anonymous users, service-tier accounts, or back-door credentials. When your credentialing changes — a provider leaves, a new CRNA joins — your admin moves the role the same day; the auditor who pulls the user list later sees a record of who did that, and when.

• Two roles defined for your deployment: `user` (clinicians and staff) and `admin` (your provisioning team).
• Every sign-in is logged — who logged in, from which IP, against which role.
• Provisioning and de-provisioning run through your admin, not ours. We do not hold standing credentials to your tenant.
• A single BAA covers the AIMS feed, the EHR connection, and the Anesloop cloud, so compliance signs one agreement instead of three.

03 · Audit trail and replay for chart reviews

Audit trail and replay for chart reviews.

Every screen view, every clearance edit, every draw on a controlled-substance line gets a row in the audit log. The row records the user, the timestamp, the chart or vial in scope, and the change itself — not a paraphrase, the change.

A post-hoc compliance reviewer can replay the sequence in the order it happened: who opened the chart, who cleared the hold, who witnessed the wastage, who signed off. Pulling that trail for a surveyor or an internal chart review is a single exported artifact, not a meeting with engineering.

• Read events: chart opens, clearance views, substance-log reads.
• Write events: clearance approvals and edits, lot draws, wastage captures, count submissions.
• Audit rows carry user id, role, timestamp, target id, and a before/after snapshot for write events.
• Replay available as a documented, exportable sequence — not a manual SQL pull by your team.

04 · DEA-relevant retention for the narcotics reconciliation ledger

DEA-relevant retention for the narcotics reconciliation ledger.

Every controlled-substance entry captures lot number, witness initials, and wastage at the moment of administration — not in a morning reconciliation that an auditor has to chase. Shift-to-shift count drafts roll up automatically; the monthly packet aligns with state-specific roles (pharmacist, DEA registrant, prescriber) and Form 41–style reconciliations.

We retain the reconciliation ledger and its audit chain through any inspection window your state or your surveyor asks for. The auditor can trace any vial from receipt to disposal on a pull, with both the human initials and the lot number sitting next to each wastage line. We do not erase rows on a calendar — we retain until you tell us to, or until your regulator's retention rule is met, whichever is later.

• Point-of-administration capture: lot number, witness, wastage — written once, not re-keyed later.
• Shift-to-shift count drafts roll up; monthly packet aligns with state-specific roles and Form 41–style reconciliations.
• Reconciliation ledger carries the full audit chain — a vial can be traced from receipt to disposal.
• Retention is framed against your state's inspection window and your regulator's record-retention rule, not a fixed calendar date.

05 · No model training on your clinical data

No model training on your clinical data.

Your clinical data stays your data. We do not train, fine-tune, or evaluate any model on the PHI that flows through Anesloop — pre-op charts, clearance decisions, OR schedules, substance logs, or payer follow-up notes.

If a future feature ever calls for using your data to improve a model — a custom screening rule, a site-specific tuning run — that runs only under a separate written authorization naming the data, the scope, and the term. Without that document on file, your data is not used for model improvement. Period.

• No training, fine-tuning, or evaluation runs on customer PHI by default.
• Any future use of your data for model improvement requires a separate written authorization on file — naming data, scope, and term.
• Your records live in the regional Postgres cluster you deploy into; we do not move them into a shared training set.