Security & control
Patient data, protected. Access you control.
A HIPAA compliance program, production data hosted only in US cloud regions, encryption in transit and at rest, and experienced billers reviewing agent work.
A HIPAA program, run as your business associate.
A designated Security Officer and Privacy Officer, continuous control monitoring in a compliance platform, and a BAA before any patient data is shared.
HIPAA program
Run as a business associate, with a designated Security Officer and Privacy Officer.
BAA first
A Business Associate Agreement before any patient data is shared.
Continuous monitoring
Our controls are monitored continuously in a compliance platform.
Threat detection
Infrastructure activity is captured by cloud audit logging and threat detection.
Protected data.
- US cloud regions only
- Production data is hosted only in US cloud regions, with disaster recovery in a second US region and nightly backups in a separate, isolated account.
- Encrypted in transit and at rest
- TLS 1.2 or higher in transit. Databases, document storage, backups and stored credentials are encrypted at rest.
- No public entry points
- No public IP addresses or public database endpoints. Traffic enters only through load balancers behind a web application firewall.
- No model training
- AI providers process your data only to fulfil our requests. It is not used to train their models.
Controlled access.
- Multi-factor sign-in
- Staff sign in with multi-factor authentication. Platform users have a one-time-passcode second factor and short idle timeouts.
- No SSH to production
- Cloud console access requires multi-factor authentication. There is no SSH access to production.
- Every change recorded
- Every change to a claim, charge, rejection, denial or aging work item is recorded with the user and time.
- Reviewed, tested code
- Every code change is peer-reviewed and must pass automated tests before merge. Dependencies are scanned continuously.
Not enough evidence? A biller decides.
When there is not enough evidence to decide, an agent action is held for review by an experienced biller. Every agent action on a claim is recorded in its action log.
Not enough evidence.
The proposed action falls below the confidence threshold and is held for review by an experienced biller.
- 01Agent · proposed action
Propose a payer correction.
The agent proposes an action on a claim.
- 02Confidence check · below threshold
Hold for biller review.
Not enough evidence to decide. An experienced biller reviews the action.
- 03Specialty biller · decision
Review the proposed action.
The biller decides what happens next.
- 04Action log · entry
Record it in the claim’s log.
Every agent action on a claim is recorded in its action log.
Biller review
Not enough evidence? A biller reviews the action.
Pause per client
Automation can be paused per client at any time.
Action log
Every agent action on a claim or work item is recorded.
Guardrails
Agent conversations are checked for prompt injection and other common attacks.
You stay in control.
Your users
Named, role-based accounts. You control your users and can revoke access at any time.
Your automation
Automation can be paused per client at any time.
Your exit
On exit we return your data in standard formats and delete it as the BAA directs.
Your review
Recovery objectives are documented. We share them under NDA in a security review.
Security questions.
How is patient data encrypted?
Data is encrypted in transit (TLS 1.2 or higher, HSTS) and at rest with managed KMS keys with key rotation. Databases, document storage, backups and stored credentials are all encrypted.
Where is our data hosted?
Production data is hosted in US cloud regions only, with disaster recovery in a second US region and backups copied nightly to a separate, isolated account. Production workloads have no public IP addresses and no public database endpoints; ingress is only through managed load balancers behind a web application firewall. Recovery objectives are defined and documented; we share them under NDA in a security review.
Do AI providers train on our data?
No. Model providers process your data only to fulfil our requests. It is not used to train their models. We require a Business Associate Agreement from every AI subprocessor that handles patient data.
What happens when an agent is unsure?
Agent actions are held for review by an experienced biller when they fall below configurable confidence thresholds, that is, when there is not enough evidence to decide. Automation can be paused per client at any time. Every agent action on a claim or work item is recorded in its action log, and agent conversations pass through guardrails for prompt injection and other common attacks.
Who can access our data?
Staff sign in through multi-factor authentication, cloud console access requires MFA, and there is no SSH to production. Platform users get named, role-scoped accounts with a one-time-passcode second factor and a short idle timeout. You control your own users and can revoke access at any time. Infrastructure activity is captured by cloud audit logging and threat detection.
What happens to our data when we leave?
On exit we return your data in standard formats and delete it as the BAA directs. Records we are required to keep under HIPAA are retained for six years, access-restricted, then destroyed.
What about SOC 2 and penetration testing?
Both are in process. We share current status in a security review.
Start with a security review.
Bring your IT and security team to review these controls. We share documented recovery objectives under NDA.
BAA before sharing patient data.