Security Architecture

Every chart entry — assessments, vitals, observations, narratives — is stored on the nurse's device. We do not operate a server-side database of patient records.

• No cloud database of charts. No server-side copies of narratives. No PHI in our backups, because there are no PHI-bearing backups to take.
• No accounts, no logins, no user sessions, and no passwords. The app does not authenticate the nurse; access to PHI is governed by the device's own lock screen and by on-device encryption.
• No data centers handling PHI for this app. The Vercel proxy used for narrative generation (described in Network architecture below) is implemented so our application code does not write request bodies to logs or storage, and no Vercel log drains or third-party log integrations are configured for the project. For facility deployments, the Vercel HIPAA add-on (BAA-eligible) covers this contractually.

Because there is no centralized PHI store, there is no bulk-breach-notification surface in the way a cloud-hosted EHR has.

All PHI written to device storage is encrypted by the app before it reaches AsyncStorage. This is application-level encryption — separate from, and additional to, the operating system's own at-rest encryption.

• Algorithm: AES-256-CBC with a freshly generated 128-bit initialization vector (IV) per encryption operation.
• Key size: 256 bits, generated on first launch by the platform cryptographic random source.
• Storage layer: Encrypted ciphertext is written to AsyncStorage. The Redux store, narratives, room assignments, and app settings all flow through the same encrypted-storage service.

Implementation: src/services/storage/EncryptedStorageService.ts using the react-native-aes-crypto and react-native-keychain libraries.

The AES-256 encryption key lives in the device's platform-native secure storage and never leaves the device.

• Keys are generated on the device and never exported from secure storage.
• Keys are device-bound — they are not backed up to the cloud and cannot be moved to another device.
• We do not operate hardware security modules (HSMs) or a key-escrow service. There is nothing on our side to compromise to recover a destroyed key.

When the nurse taps End Shift, the app destroys the encryption key — making any encrypted data remnants on disk mathematically unrecoverable. This is the data destruction model: not deletion, cryptographic erasure.

1. Overwrite — all PHI storage keys are overwritten with random data.
2. Delete — the storage keys are removed from AsyncStorage.
3. Key destruction — the AES-256 encryption key is destroyed in Keychain/Keystore via resetGenericPassword.
4. State reset — the Redux store is dispatched to its initial state.
5. Re-initialization — a fresh encryption key is generated for the next shift.

This approach is consistent with NIST SP 800-88 guidance on media sanitization via cryptographic erase. There is no key rotation schedule because the key only ever holds for one shift.

We block PHI from leaking through OS-level backup mechanisms.

• iOS: app data is excluded from iCloud backup and marked with NSFileProtectionComplete, so it is encrypted on disk by the OS while the device is locked.
• Android: the manifest sets android:allowBackup="false" and android:fullBackupContent="false" to opt the app out of Google Drive's automatic backup of app data.

The app does not maintain a connection to a PHI backend. Two narrow opt-in flows touch the network on the nurse's explicit request — both described below.

Nurse Charting Pro is a software tool designed to support a HIPAA-aligned nursing workflow. The architecture implements technical safeguards relevant to the HIPAA Security Rule — at-rest encryption (45 CFR §164.312(a)(2)(iv)) and access control via the device's own lock screen — and avoids a centralized PHI store. A complete HIPAA program also requires administrative and physical safeguards owned by the deploying covered entity.