Safeguards in the product
- Two-factor sign-in, which an administrator can require for every user
- Account lockout for 15 minutes after five failed sign-ins, plus attempt limits per network across all accounts
- Security headers that stop the app being framed by other sites, and no referrer sent from pages whose links carry a secret
- A full export of the practice's data for its administrators, recorded in the audit log
- Four roles (administrator, biller, front desk, read-only), plus custom roles that can only narrow them, checked on every request
- Single sign-on through your identity provider (OpenID Connect or SAML 2.0) and SCIM to remove access when people leave
- Password resets by one-time emailed link that ends every other session
- Per-practice session length and an optional allowlist of office networks
- Every record scoped to its practice, with ownership checked on every change
- Posted amounts never edited; corrections post as reversals
- An audit log of sign-ins, claims, payments, exports and settings changes, exportable by administrators
- Patient links, API keys, SCIM tokens and recovery codes stored only as hashes
- Server errors recorded with patient details masked, and no request headers or query strings kept
- Integration keys and authenticator secrets encrypted (AES-256-GCM) before they are stored
- HTTPS everywhere, and a certificate-verified TLS connection to the database
- Card numbers entered on Stripe's hosted page, never on our servers
- A compliance center for practices: control checks, access reviews and a vendor BAA register
More detail on the security page.
Independent assurance, honestly
- Security safeguards built into the product (listed above), covered by automated tests
- Tools for practices to evidence their own HIPAA safeguards: access reviews, audit export, BAA register
- SOC 2 Type I or Type II audit by an independent firm: not yet completed
- Third-party penetration test: not yet completed
- HITRUST certification: not pursued yet
We would rather tell you what has not been done than let a badge imply it. When an audit is completed, its report will be available here under NDA.
Services that process data
| Service | What for | When |
|---|---|---|
| Vercel | Application hosting | Always, for the hosted service |
| Neon | Database hosting (PostgreSQL) | Always, for the hosted service |
| Stedi | Clearinghouse: claims, eligibility, status, remittances | Only for practices that connect it |
| Stripe | Card payments and saved cards | Only for practices that connect it |
| Twilio | Text messages to patients who agreed to texts | Only for practices that connect it |
| Resend | Email to patients and staff | Only for practices that connect it |
| Anthropic | AI: denial explanations, appeal drafts, coding help, report questions, insurance card reading | Only for practices that connect it |
Practices connect the optional services with their own accounts, so the agreement with each (including any business associate agreement) is between the practice and that service. The compliance center inside the product keeps a register of them.
What AI sees
AI is off until a practice connects its own Anthropic account. When on, denial explanations and appeal drafts are written from codes only (CARC, RARC, CPT, ICD-10, payer type); patient names, dates of birth, member IDs and addresses are filled in by our servers after the AI answers. Import column matching sends column headers and the shape of values, never the values. Questions asked of the report builder send the question and the practice's payer and provider names, never report results. Coding from full visit notes and reading insurance card photos, which contain patient information, stay off unless the practice confirms it has a BAA with Anthropic.
Questions and agreements
Our answers to the usual vendor security questions are in the security questionnaire (also as CSV). The business associate agreement page explains what it covers. For your own questionnaire or anything else, contact us. To report a vulnerability, write to us through the same form and mark it security; please do not test against other practices' data.