Account Security Terms for Patients

These terms apply to your RecordsFlow account. They are separate from the RecordsFlow Privacy and Security Notice, which explains what health information we collect, how we use it, and your rights over it. Read both.

If we change these terms, we will tell you before the change takes effect.

1. Two-step sign-in is required

To use RecordsFlow, you set up two-step sign-in when you create your account. Signing in then takes two things: your password, plus a code sent to your phone.

This is required by the health data exchange rules RecordsFlow operates under. It cannot be turned off.

2. How you get your codes

You can use a text message to your phone or device.

We will text you sign-in codes at the number you give us. Those texts contain nothing but a code — never your records, and never any health information. Standard message and data rates apply.

3. Keep your sign-in to yourself

Your sign-in is yours alone. Do not share your password or your codes with anyone, including your attorney or their staff.

If someone asks you for a sign-in code, do not give it to them. We will never ask you for one.

4. If you lose access

If you lose your phone or believe your account has been compromised, contact us and we will help you set up a new one.

Because your account is tied to your verified identity, we need to confirm who you are before we can make that change. That may mean going through identity verification again. We do this so that someone who gets into your email cannot get into your records.

5. Security problems and account holds

If you think someone else has used your account, or you get a sign-in code you did not ask for, contact us right away. An unexpected code can mean someone has your password.

We may place a temporary hold on your account if we see sign-in activity that suggests someone is trying to break into it. We will email you if that happens and explain how to get back in.

A hold does not delete your records and does not change your right to get a copy of them, export them, or ask us to delete them.

Questions or a security problem