Today we accept no patient information

• No patient information comes to us before a business associate agreement (BAA) is signed by both sides.
• For a practice, we are its business associate. For a billing firm, we are its subcontractor.
• We sign our BAA or yours after reading it.

• Office files go to a separate server used only for office cases.
• It runs on Amazon Web Services (AWS), in a United States region, under AWS's business associate addendum.
• No storage, access or support from outside the United States.

• Every upload and download uses HTTPS.
• The server's disk and every backup are encrypted. Backups expire after 7 days.
• Patient files never go by e-mail. If you e-mail us patient information by mistake, we delete it and tell you.
• The office pages run no advertising, analytics or third-party scripts.

• Each person at your office gets an invite-only account with two-step sign-in. No shared accounts and no public sign-up.
• Each office sees only its own cases.
• On our side, one person has access: our owner, who is also our security official. The owner signs in with a passkey or security key.
• Nobody else gets access without a signed confidentiality agreement, HIPAA and Texas privacy training, and written notice to you.

Every sign-in, upload, view, download, edit, sign-off and erase is logged with the account and the time. The log holds case codes, not patient names. We review it every day, and you can ask for your office's entries at any time.

• Each case is erased 30 days after its packet is ready, or within 3 business days if you ask sooner.
• At the end of the pilot, we return what you ask for and erase everything within 30 days. Backups expire 7 days later. You get a signed certificate.
• We keep only counts with no patient details. We never sell, rent or market your data.

• We tell your privacy contact by phone and e-mail immediately, and no later than 48 hours after we find a problem.
• A written report follows within 10 calendar days.
• You decide on notices to patients and regulators. We give you the facts in time for your deadlines.

• A risk analysis made with HHS's Security Risk Assessment workbook, repeated every year.
• Written security and privacy policies, kept for 6 years.
• A yearly HIPAA and Texas privacy training record (Texas Health and Safety Code ch. 181).
• Errors-and-omissions and cyber insurance that covers our duties as a business associate. We share the certificate.