Surely encrypts data in transit and at rest, and is designed to handle personally identifiable health information in accordance with New Zealand law. Patients are in control of their own health records throughout, and Surely deletes stored health data on a set schedule (see Data retention below).
Surely is designed to meet New Zealand health information legislation, including:
Surely connects to Practice Management Systems via a standards-based, authenticated Fast Healthcare Interoperability Resources (FHIR) integration. Surely connects with its own partner credential, not practice login credentials. No data beyond what is covered in the consented authorisation is accessed.
We only keep health data for as long as we need it to complete a request. Once a request is complete, or can't be completed, the records and the consent behind them are deleted automatically on a set schedule.
Deleted information may stay in our encrypted backups for a period afterwards. Some backup copies are currently kept for longer while we confirm how long they should be held.
After the health data is deleted, we keep an audit record of each request, approval, access and delivery. It holds reference numbers, event types, timestamps and processing details such as record categories and counts, and is designed not to contain health data.
Our application and security logs are kept for set periods, and known health-data fields are removed from application logs. For our full retention schedule, contact security@surely.nz.
If you discover a security vulnerability in Surely's platform, please report it responsibly to security@surely.nz. We aim to acknowledge reports within 2 business days and work to resolve confirmed vulnerabilities promptly.
For security enquiries, contact us at security@surely.nz.