Security & Privacy
How HL7 Workbench protects your data
PHI-Safe by Design
HL7 messages are parsed and validated entirely in your browser. The full message is never uploaded to a server. One exception: when terminology server validation is enabled (the default), the individual coded values being checked (code, code system, and display text) are sent to the terminology server as lookup queries. Enable Offline Mode in the parser settings to guarantee no message-derived data ever leaves your browser.
Client-Side Architecture
The HL7 message parser runs entirely in your browser using a dedicated Web Worker and JavaScript. When you paste or load a message, it is parsed, validated, and displayed without leaving your device. The API server provides schema definitions and terminology lookups. Your message is never uploaded as a whole. Terminology validation and code lookups transmit only the individual coded values being checked (code, code system, and display text) as lookup parameters, and even those stay on your device in Offline Mode or when the terminology server is disabled.
PHI Masking
HL7 Workbench includes built-in PHI detection and masking. Three modes are available: Off (no masking), Hide (mask PHI fields with click-to-reveal cursor unmask), and Delete (permanently redact, delete, or anonymize PHI fields). PHI detection uses field-level metadata from the HL7 specification to identify patient identifiers, names, addresses, and other sensitive data.
Offline Mode
For environments with strict data policies, Offline Mode caches the schema locally so that no network requests are made during parsing or validation. Terminology lookups are disabled in offline mode since they require server queries, but all schema-based validation continues to work.
Encrypted Persistence
Messages stored in the Messages Browser are encrypted in IndexedDB using AES-256-GCM. The encryption key is a non-extractable CryptoKey generated by the Web Crypto API and stored persistently in IndexedDB. Optionally, messages can be protected with a passphrase-derived key via PBKDF2. Settings and layout preferences are stored in localStorage without encryption since they contain no PHI.
Browser Storage Limitations
While messages are encrypted at rest, anyone with physical access to your device and browser could potentially access the decryption key from memory. For maximum security, close the browser tab when finished and use Offline Mode in sensitive environments.
Server Request Logs
API requests are logged for security and abuse prevention. Each entry records the IP address, the path requested, the response status, how long it took, and the account id when you are signed in. No message content is logged — parsing happens in your browser, so the server never receives a message to log.
Retention: request logs rotate and are discarded on a short cycle — no address is kept long-term today. IP addresses are personal data under GDPR; the hosting layer records them for operational purposes regardless, and they are used only to operate and protect the service — never for advertising or profiling, and never shared with third parties. Much of this service can be browsed without an account, so an IP address is the only way abuse of those pages can be identified at all.