Security and Compliance

Hands typing on a laptop keyboard with code on screen.

Your Data Is In Good Hands.

At Expedited Reports, protecting sensitive student information is foundational to everything we do. Our platform is built with enterprise-grade security protections designed to support the secure handling of educational and health-related data across every layer of our organization.

We maintain rigorous security, privacy, and confidentiality standards and are prepared to partner directly with school districts to complete IT security questionnaires, vendor reviews, and compliance documentation requests. Additionally, we are happy to lead data privacy discussions with district leadership and technology teams.

Security Standards That Set The Bar.

FERPA & HIPAA Compliance

Expedited Reports maintains operational and technical safeguards designed to support stringent HIPAA- and FERPA-compliant handling of sensitive student and health-related information. We are one of the only psychoeducational report writing companies that meets both HIPAA and FERPA compliance.

Advanced Encryption Standards

All data is encrypted:

At rest using AES-256 encryption
In transit using TLS 1.2 and TLS 1.3 encryption
Through secure HTTPS communication protocols

Legacy protocols such as TLS 1.0 and 1.1 are disabled.

Access Controls & Authentication

Access to district data is restricted through:

Named authenticated user accounts
Role-based access controls (RBAC)
Administrator-managed permissions
Least-privilege access practices
Session timeouts after inactivity

District data is logically segregated to prevent cross-district data exposure.

Human-Led Quality & Accountability

Every report draft undergoes direct human review. All reports are drafted and reviewed by qualified professionals, and districts maintain sole authorship and responsibility for final eligibility determinations and approvals.

Edits, assignments, and report activity are attributable to named users to support accountability and full transparency.

Monitoring, Logging & Oversight

Expedited Reports maintains audit logging and monitoring practices designed to support oversight, security reviews, and incident investigations. Access logs can be made available to authorized district stakeholders upon reasonable request. Access permissions are reviewed regularly and adjusted based on role changes or service termination.

Data Retention & Deletion

Student data is retained only as long as necessary to support contracted services, revisions, quality assurance, and operational continuity.

Typical retention practices include:

30–60 day retention following report completion or contract termination
Earlier deletion upon written district request
Secure deletion from active systems and backup environments in accordance with internal retention schedules

Security logs may be retained longer for monitoring and incident response purposes.