The Ocean Platform was built from the ground up to ensure patient health data is kept private and secure, using client-side patient encryption technology. All patient data sent to and stored within Ocean is encrypted end-to-end using the industry-standard 256-bit AES, the same technology used for online banking.

To further guard against any possible breach of personal health information on our Ocean servers, patient data is encrypted using a private key, created by and known only by health clinic administrators. Since encryption keys are kept private and stored locally within each individual clinic, no agent outside of the clinic can ever decrypt or read private patient information. This ensures that even the most trusted staff and technical team members at CognisantMD are completely unable to read patient charts or any private health information.

No. As noted above, CognisantMD is committed to keeping patient data secure using the most stringent approaches to data security and privacy. Furthermore, since all data is fully encrypted, CognisantMD cannot access personal health information in a readable format. In this encrypted state, data is meaningless and can not be commoditized or sold to a third party, including the parent company of Ocean by CognisantMD, WELL Health Inc.

Ocean by CognisantMD is not an Electronic Medical Record (EMR) system and not designed to act as a long-term repository of health information. All patient data is stored in encrypted form only for a limited time in order to support patient care. During that time period, only healthcare providers with a secure login and access to the clinic’s unique encryption key can access decrypted patient health information residing in Ocean. Once patient data has been successfully downloaded to the patient chart in the clinic’s EMR, it is routinely deleted from the Ocean Platform. All Ocean data, including client-side encrypted PHI, is stored in our primary storage facility located in Montreal, with additional copies of the data kept in a warm failover disaster recovery facility in Toronto.

Traditional email communication comes with a lot of privacy risks – emails and their contents can easily be forwarded without your knowledge, messages may be sent to the wrong address, and more. To combat some of these risks, we ask you to confirm your identity through a quick validation process to make sure you are the correct and intended recipient. By default, we will always ask for a birth date because it is an easy piece of information for you to remember. We then use that birth date to check against your patient record to ensure there is a match. Only then will you be able to see the contents of the message.

In some cases, your health care provider might ask for additional information. This can include your health number, your patient record number, or a pre-determined access word that you and your provider agreed upon. Just to be clear, Ocean does not collect or use your birth date or other PHI when we run the validation checks.

Depending on your healthcare provider’s settings, messages may be delivered from their clinic email address or “no-reply@cognisantmd.com.” The contents of the message can vary from provider to provider, but for the most part they will look the same. Please take a look at some examples below.

As an additional security measure after you click on the link, look for a “lock” symbol in your web address bar. This means the site is safe and there is a private connection. These security settings can vary depending on the browser you use so it’s always a good idea to understand how your browser identifies safe and unsafe websites.