Summary
Cloud-based EHR software is an electronic health record hosted by the vendor and opened through a browser or app, so the practice runs no server of its own. Updates and backups sit with the vendor, and clinicians can open the chart from any approved device. Elation, for example, describes a secure cloud-based EHR built for primary care. The strongest cloud systems earn their place on 4 points, where the data is hosted, who can open each record, how every access is logged and how the practice takes its data with it. In the US a vendor handling patient data signs a business associate agreement, and in other countries hosting location decides which law applies. Wai is a clinic platform hosted in each clinic's own country, with AES-256 encryption at rest, TLS 1.3 in transit and role-based access enforced in the database. Ask every vendor for those 4 answers in writing, then test them on 1 real patient record during the demo.
Each rival detail comes from that company's own page, read 9 November 2026. 123
See it in your clinicYou can be running this week. No procurement, no minimum term. A 7-day trial, then one published price.
Request a demo| Question | Why it matters | Strong answer | Wai's answer |
|---|---|---|---|
| Where is the data hosted? | Location decides the governing law | A named country in the contract | Each clinic's own country |
| How is data protected? | Security Rule safeguards | Stated encryption at rest and in transit | AES-256 at rest, TLS 1.3 in transit |
| Who can open a record? | Least-privilege access | Roles enforced by the system | Role-based access in the database |
| Is access logged? | Audit controls | A log the practice can read | Every read of a record logged |
| How do we take data with us? | A clean exit | Standard export, written terms | Signed notes and letters export into any system |
Cloud as the default
Office practice has moved firmly onto electronic records, with 95% of US office-based physicians using an EHR in 2024.4 Cloud hosting moves server upkeep and backups to the vendor, which frees a small team for patient work.
The decision that remains is the quality of the hosting. A clinician's duty to the record stays with the practice wherever the server sits.
The safeguards to verify
The HIPAA Security Rule requires access limited to authorised people and mechanisms that record and examine system activity. Encryption in transit is an addressable specification, applied whenever deemed appropriate.5 A vendor handling protected health information gives written assurance of safeguards through a business associate agreement.6
Ask to see the access log for 1 record, and name the storage country in the contract. Where patient data lives covers the residency side.
Wai on 1 cloud record
Wai hosts each clinic's records in its own country, under that country's rules, and holds a SOC 2 Type II report sent under a mutual non-disclosure agreement.7 US practices sign a business associate agreement before go-live.8
The record reaches beyond the chart. Calls, messages, booking and payments sit beside the signed note,9 so 1 platform replaces several point tools for many private clinics. Plan the move with the switching checklist.
Bring your security questionnaire. We answer it control by control.
Request a demoFrequently asked questions
What does cloud-based EHR mean?
The vendor hosts the record and the practice opens it through a browser or app, with updates and backups handled by the vendor.
Is a cloud EHR HIPAA compliant?
HIPAA has no certification. Readiness depends on the signed agreement, the safeguards and how the practice operates them.8
Do we need a business associate agreement with a cloud EHR vendor?
Yes, where the vendor handles protected health information for a covered practice. The assurance must be recorded in writing.6
Where does Wai store records?
In each clinic's own country, under that country's rules, set up with the clinic before go-live.8
Does Wai have a SOC 2 report?
Yes. Wai holds a SOC 2 Type II report, sent under a mutual non-disclosure agreement.7
How do we check a vendor's export?
Ask for a sample export of 1 record before signing, and write the format into the contract.
Sources
- Elation Health home page, read 9 November 2026
- Pricing, read 9 November 2026
- Pricing and plan comparison, read 9 November 2026
- Office-based Physician Electronic Health Record Adoption, 2008-2024, Data Brief 84, read 9 November 2026
- 45 CFR 164.312, technical safeguards, read 9 November 2026
- 45 CFR 164.502, uses and disclosures of protected health information, read 9 November 2026
- SOC 2 at Wai, read 9 November 2026
- HIPAA at Wai, read 9 November 2026
- The clinic platform, read 9 November 2026
See your clinic on 1 secure record
Bring one real clinic day and we will walk through it on your own workflows. We reply within 24 hours.
Partner with us
See it on your own patients, then build it with us
Thirty minutes on your own patients, doctors and rules, in your market. We reply within one working day, and the clinics that partner with us early shape what we build next.
See what Wai does between the visits