Effective July 24, 2026 · LabX Diagnostic Systems, LLC
Protecting patient and employee health information is core to how we operate. The safeguards below summarize our administrative, physical, and technical controls.
All connections to our sites and portals are served over HTTPS. Our servers negotiate TLS 1.3 with AES-256-GCM authenticated encryption, and HTTP Strict Transport Security is sent with a one-year max-age, applied to all subdomains, and submitted to the browser preload list — so a browser refuses to connect to us over plaintext HTTP even on a first visit. Plaintext HTTP is redirected to HTTPS.
Application data, including databases holding PHI, is stored on encrypted volumes in our AWS environment, and backups are encrypted. Particularly sensitive records — a patient’s shipping details on an open order, for example — are additionally encrypted by the application itself with AES-256-GCM before they are written, and are deleted once the order they belong to has shipped rather than kept indefinitely.
Access to PHI is role-based and limited to authorized personnel on a minimum-necessary basis. Portal accounts are individually authenticated, sessions are signed and time-limited, and administrative access requires login. Repeated failed login attempts are rate-limited.
Administrative actions and access to PHI-bearing pages are recorded in an audit log (actor, action, path, IP, timestamp) to support monitoring and incident review.
Our pages send security response headers — X-Content-Type-Options: nosniff, X-Frame-Options: DENY, Referrer-Policy and Permissions-Policy — and mark PHI pages no-store so they are not cached by browsers or intermediaries. A Content-Security-Policy is published in report-only mode, which reports violations to us without yet blocking them; we say so rather than claim an enforcement we have not switched on.
Your specimen is tested in our laboratory. We do not send it to another company’s laboratory and re-badge the result, and there is no referral arrangement in which somebody else runs the test. The systems that receive, order, result and report on that work — the laboratory information system, the ordering screens, the patient portal and the report you read — were built by us rather than licensed from a vendor. Fewer companies handle your information because fewer companies are involved at all.
Vantage AI can explain your own results to you. It runs on a model operated by Anthropic, PBC (the Claude API) — an outside vendor, and we treat that as the risk it is.
We hold no Business Associate Agreement with the model vendor. Rather than rely on one, we changed what is sent so that no protected health information leaves.
What is sent is a de-identified extract: marker names, your values, units, reference intervals, the laboratory’s own flags, your sex, and an age band such as 40–49.
What is never sent:
The question you type is cleaned as well. It is the one field we do not
control, and people naturally write “I’m Alex, 46, born 5/2/1980”. Names,
dates, ages, e-mail addresses, telephone numbers, postal addresses and record numbers are
removed from the text before it is sent, and replaced with [removed]. We redact
rather than refuse, so a real question still gets a real answer.
The question you typed is kept on our side, encrypted, as the record of what was asked. That record is ours and is not a disclosure — and a patient typing their own name into a box is not authorization for us to pass it to a vendor, which is why the cleaning happens regardless.
The assistant cannot reach anything else. It is given only the results we already hold for you, drawn from the same provenance-checked source the portal reads, so it can never discuss a value the portal itself would refuse to show. If you have no released results, it does not open at all. It does not diagnose, does not advise on treatment, and never softens or explains away a flag the laboratory applied.
This is verifiable rather than asserted. Everything that leaves is built by a single function, and a self-test calls that same function to print the exact bytes and confirm each identifier is absent — that changing your order number, your collection date, your release date or your exact age does not alter one byte of what is sent. We keep a written record of the payload shape for review.
A value cannot appear on your results page unless it arrived from the laboratory through the live feed, or was transcribed from a signed report by the laboratory director. This is checked when the page is drawn, not when the record is saved, so a value that was never produced by the laboratory cannot be made visible after the fact. Demonstration values are labeled as such wherever they appear and have no printable report.
We enter into Business Associate Agreements with vendors that handle PHI on our behalf (including cloud hosting, e-signature, and payment processing) and require them to maintain HIPAA-compliant safeguards.
In the event of a breach of unsecured PHI, we will investigate, mitigate, and notify affected individuals and regulators as required by the HIPAA Breach Notification Rule.
← Back to home