> ## Documentation Index
> Fetch the complete documentation index at: https://docs.voxhealth.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> How access is controlled, and what you are responsible for.

VoxHealth handles protected health information. This page covers what the platform does and what your practice has to do.

## Access control

**Every user has their own account.** Sign-in is by email and password.

**Two-factor authentication** is available per user under **Security** in your profile. When a user has enrolled, their session must satisfy that second factor before it can reach practice data. Enrolment is not a badge, it is enforced.

**Roles decide what a user can see.** See [Roles and permissions](/team/roles-and-permissions).

**Enforcement is in the database.** Access is checked row by row when data is read or written, not by hiding menu items. A user who navigates directly to a page they should not have gets an empty page rather than a leak. Hidden navigation is a convenience; the data layer is the boundary.

## What is logged

Configuration changes and access to sensitive records go to the [audit log](/practice/audit-log), which is append-only. No one can edit or delete an entry, including admins.

Every message sent to a patient is recorded in **Settings → Notification Log**. Every call is recorded, transcribed, and stored in [Calls](/front-desk/calls).

## What your practice is responsible for

<CardGroup cols={2}>
  <Card title="Individual accounts" icon="user">
    No shared logins. A shared account destroys the audit log's usefulness and outlives the person who set it up.
  </Card>

  <Card title="Prompt offboarding" icon="user-minus">
    Remove access the day someone leaves.
  </Card>

  <Card title="Two-factor for admins" icon="key">
    Admins can change integrations, routing, and billing. Enrol them.
  </Card>

  <Card title="Service accounts for integrations" icon="plug">
    Connect your PMS with an account created for VoxHealth, not a staff member's personal login.
  </Card>

  <Card title="Access review" icon="list-check">
    Review who has access, and at what role, on a schedule. The audit log is the record you review against.
  </Card>

  <Card title="Portal credentials" icon="lock">
    If you use [portal automation](/revenue/portal-automation), those are real payer credentials. Treat them accordingly.
  </Card>
</CardGroup>

## Reporting a problem

Email [support@voxhealth.ai](mailto:support@voxhealth.ai). If you believe patient data has been exposed, say so in the first line so it is triaged as an incident rather than a support question.

## Related

* [Patient privacy](/security/patient-privacy): how PHI is handled specifically
* [Audit log](/practice/audit-log)