Anastomo — verifying a practice

Practices · verification

What verifying a practice keeps

Before a practice can send a patient their record sealed to the patient’s own key, Anastomo verifies that the practice controls its email address. It is the one thing about Anastomo that runs on a server of ours, and this page says what that server keeps. It is written to be checked against the code, which is open.

Verification is not running yet. This is what it will keep when it does.

01What is checked That the practice controls its email address: we mail a six-digit code there, and the practice types it into the app. That is all that is checked. The practice’s name, address and phone are shown to patients as the practice gave them, and labelled that way.
02What we keep The practice’s registration: its email address, the name, address and phone it declared, and for each computer acting for it the public half of that computer’s signing key, when it was added and whether it is active — and the certificate each is issued, with its dates. A patient connecting to the practice is shown the same certificate, so none of it is private. While a code is waiting, we keep a hash of it — never the code — for fifteen minutes, and a hash of the address to limit how many codes it is sent.
03What we never have Anything about a patient. Records go from the practice to the patient sealed to the patient’s key, by the practice’s own email; they never pass through us, and we could not read them if they did. A certificate entitles a practice to nothing: records move only when a patient connects to it.
04Where Google Cloud, in the us-east4 region: the certificates in a private storage bucket, and the key that signs them in Cloud KMS, which never lets the key out. The codes are mailed from codes@anastomo.io through Google Workspace.
05Another computer A second computer verifying the same address does not get a certificate on the code alone, since anyone who could read the practice’s mail could otherwise pass as it. A computer the practice already has approves it; or, if none does within 72 hours, it is let in — the way back for a practice whose only computer is gone. The practice’s address is told either way. A new practice declaring a phone number another one declared is told to that practice too.
06Ending it A certificate lasts a year. A practice can retire any of its computers from another, which revokes that computer’s certificate; a practice that asks us to revoke one is taken off the list we serve, and patients’ pages then refuse it.

Questions go to ted@anastomo.io. This page changes only when the code does.