Privacy notice

Notice covering alleghenyhealthrecords.com and the AHR clinical record platform

Allegheny Health Records (AHR) builds health record software for regional care organizations. This notice explains what information this website and its signed-in workspace handle, and what choices you have. AHR is not a medical provider. If you receive care from a participating organization, direct questions about your treatment or your HIPAA rights to that provider’s privacy officer.

Session and workstation data

Signing in sets one first-party cookie, ahr_session, which keeps you signed in. Two more cookies, workstation-identity and workstation-trust, let the workspace recognize a device you have used before and apply stricter checks on one it has not. None of them are used for advertising, and they expire with the session or within thirty days. Our server logs record the IP address, the time, and the page requested, for security and audit purposes. We keep those logs according to the retention schedule in the acceptable use policy.

Device and browser characteristics

Administrative pages, file handling, and workspace sign-in run a check on the browser making the request. That check reads your platform and user agent, language settings, time zone and offset, screen size, color depth and pixel ratio, processor core count and reported device memory, touch capability, whether cookies are enabled, which of twenty common fonts are installed, the graphics vendor and renderer your browser reports, and a short hash of a small test image your browser draws. Taken together those readings form a signature that lets us tell one automated client from another.

We do this because a clinical record system is a standing target for credential stuffing and automated intrusion, and an IP address on its own stopped being enough to tell repeat attempts apart. The signature is used for security and abuse investigation only. It is never used for advertising, never sold, and never shared for anyone else’s marketing. It is sent to our own servers rather than to any third party, and it is discarded on the same thirty-day schedule as the rest of our security logs.

Ordinary browsing of this site does not run that check, and it is not part of viewing a public page. If you want to know whether a signature is held for a device you use, write to the privacy office at the address below.

Health information

Clinical records in the platform belong to the organizations that operate them. AHR works as their business associate: only their workforce users can reach protected health information, under the access rules those organizations set, and every lookup lands in an audit trail that cannot be edited afterward. We do not sell that information or share it outside those organizations. This website itself does not ask visitors for health information. Product screens on the public site do not contain patient data.

Google Maps

The contact page includes a Google map of downtown Pittsburgh, where our office is. Loading that page connects your browser to Google, which may receive your IP address and browser information and use its own cookies. Google handles that information under its privacy policy.

Your choices

You can turn down optional cookies and still sign in. Clearing the workstation cookies is fine too; the workspace will simply ask you to verify the workstation next time. If you hold a workforce account and want to review or correct what is tied to it, contact your organization’s administrator or our privacy office.

Contact

Questions about this notice can go to the AHR privacy office at privacy@alleghenyhealthrecords.com.