KILINIKI HMIS Back to sign in
Security Policy

How we protect your facility

The main safeguards that protect patient records and facility data in KILINIKI HMIS.

1. Access control

  • Every user signs in with a personal account and multi-factor authentication.
  • Access is based on role: staff see only the functions their role needs.
  • Repeated failed authentication attempts are locked out.
  • Sessions end after a period of inactivity.

2. Facility separation

Each facility's data is kept separate. A user's facility is set by their account, never by what is typed on a form, and access is refused if no facility is assigned.

3. Data protection

  • All connections are encrypted in transit (HTTPS).
  • Passwords are stored only as secure one-way hashes.
  • Programming interfaces require an access token; public endpoints expose no patient data.

4. Monitoring and audit

Key actions are recorded in audit logs so facilities can review who accessed or changed records.

5. Your part

  • Keep your password and authenticator private.
  • Lock or sign out of your computer when you step away.
  • Be wary of emails or calls asking for your password. KILINIKI HMIS staff will never ask for it.

6. Reporting a concern

If you suspect a security problem or data breach, follow the steps on the Incident Reporting page.