A hospital system earns trust or loses it on one question: can the wrong person see this record? We designed OlivHealth so the answer is structurally no, not because staff remember to be careful, but because the platform enforces it on every request. Here is how, in plain terms.
One hospital can never see another’s data
OlivHealth is multi-tenant: many hospitals run on the same platform, each fully isolated. Every patient, bill and record is tagged with the organisation that owns it, and that scope is applied centrally on every read and write, not left to per-query discipline. A request for a record that belongs to another organisation simply returns “not found”, so no data, and not even the existence of a record, ever leaks across a tenant boundary.
Staff see only what their role allows
Access is role-based. A front-desk user, a doctor and a hospital administrator each hold a role with a specific set of permissions, scoped to their own hospital. Someone assigned to one hospital cannot act on another, and a read-only role cannot post a bill or edit a record. Permissions are checked on the server for every action, so the rules hold no matter what the screen shows.
Access windows for staff
For staff accounts you can set operating-hour windows, the times a user is allowed to sign in and work. Outside that window the session is refused automatically. It is a simple, practical control that keeps access aligned with when people are actually on shift.
Every change is accountable
Sensitive actions are recorded. Bills, payments, refunds and voids leave an auditable trail rather than being silently overwritten, so you can always answer who did what, and when. Money is stored and computed in exact integer paise, so the numbers in that trail always reconcile.
Encryption and backups
Traffic between browser and server is encrypted in transit over HTTPS. Data sits in managed infrastructure with encryption at rest and automated backups, and it is hosted in India, which matters for hospitals thinking about data residency under the DPDP Act.
What we do not claim
We are honest about where we are. OlivHealth follows these security practices by design, but we do not currently hold formal certifications such as HIPAA or SOC 2, and we will not imply that we do. If a certification is a requirement for your hospital, tell us, we would rather have that conversation openly than overstate our position.