Skip to main content

How FCR protects your data

FCR holds sensitive information about families — including protected health information (PHI). Keeping it safe is a shared effort: FCR is built with protections in place, and your agency plays its part too (see Your part in keeping data secure).

This article covers the protections on FCR's side and how Tavor Systems, the company behind FCR, works with your agency to safeguard that data.

Your agency's data is walled off​

Every agency works inside its own private space in FCR. Your families, referrals, documents, and staff are isolated to your agency — no other agency on the platform can see or reach your data, and you only ever see your own.

Access is limited to who needs it​

Within your agency, FCR follows the principle of least access:

  • Staff members see only the families and referrals they're assigned to.
  • Supervisors see the work of the staff who report to them.
  • Practice managers and admins have the agency-wide access their role requires.
  • Especially sensitive information — like individual assessment responses and private supervisor notes — is restricted even further, visible only where it's genuinely needed.

Strong sign-in​

Every user signs in with their own account and mandatory two-step verification — a password plus a one-time code from an authenticator app. FCR also keeps sign-in error messages deliberately vague, so they can't be used to confirm whether an email belongs to a real account. See Logging in & your account.

Encryption​

Information is protected with encryption — both while it travels over the internet between your device and FCR, and while it's stored.

An activity record​

FCR keeps an internal record of key actions — who did what, and when. It covers the things that change a record — creating, editing, approving, verifying, removing — along with signing in and exporting data. That's what gives your agency an audit trail when you need one.

A few sensitive downloads are recorded too: concrete-assistance receipts, and documents uploaded to a case.

What it doesn't cover

Simply opening or reading a record isn't tracked. The activity record tells you who changed something, not who looked at it — so if you're answering a question about who viewed a client's information, the activity record isn't the place to look. Access is limited by role and case assignment instead: people only reach the records their role and caseload allow.

Nothing is stored on your device​

FCR runs online and doesn't keep client data on your device. Even when you install FCR as an app, it connects to FCR each time rather than caching records locally — so a lost or shared device doesn't carry your families' information around with it.

Working under HIPAA: the Business Associate Agreement​

FCR is built for agencies that handle protected health information under HIPAA. Agencies handling PHI enter into a Business Associate Agreement (BAA) with Tavor Systems. The BAA sets out how Tavor safeguards PHI on your agency's behalf and spells out each party's responsibilities for protecting that information.

The agreements are the source of truth

This page is a plain-language overview. The specifics of how PHI is handled are governed by the BAA and your service agreement with Tavor Systems — those documents, not this article, are the authoritative terms.

A shared responsibility​

FCR provides the protections above; your agency is responsible for how your team uses the system day to day — strong credentials, current staff access, and good data-handling habits. Your side of that is laid out in Your part in keeping data secure.

Frequently asked questions​

Can another agency see our families or documents? No. Each agency's data is isolated — you only ever see your own.

Does my agency need an agreement with Tavor to handle PHI? Yes. Agencies handling protected health information sign a Business Associate Agreement with Tavor Systems that defines how that information is safeguarded.

Is our information encrypted? Yes — both in transit (as it moves over the internet) and while it's stored.

If I lose my laptop or phone, is client data on it? FCR doesn't store client records on your device. Still, report a lost or stolen device promptly — see Your part in keeping data secure.

Need help with something this guide didn't cover? Contact support and we'll walk you through it.