Built for health information.
Expy Med is designed around patient-held records lent to a practice per visit — with encryption, access controls enforced on the server, and an audit trail on reads of patient charts.
How data is shared
Patients keep their intake record with their account. When they check in to your practice, they send the answers required for that visit. Your practice sees what was submitted for that check-in — not a permanent copy drifting in your system unless you export or file it in your EHR.
Encryption
Data is encrypted in transit and at rest as part of the cloud infrastructure Expy Med runs on. The same claim applies to the patient app and practice portal.
Access control
Authorization is enforced on the server — not only in the browser. Practice staff can access submissions and profiles for their practice according to their role. Patients can access their own records and household members they manage.
Audit logging
Reads and exports of patient submissions can be recorded — who accessed a chart, when, and from which context — so practices have a trail when reviewing access.
Business associate agreement
Practices that need a BAA for HIPAA-covered workflows can review and accept Expy Med’s business associate agreement as part of practice onboarding.
Legal documents
Review the full terms, privacy notice, and subprocessors list.
Business associate agreement Privacy notice Service providers
Questions
Contact support@expymed.com for security or compliance questions. This page summarizes product behavior — the legal documents govern your relationship with Expy LLC.