Security & HIPAA
Built for HIPAA from the first line
Patient data stays in your office. Card numbers never touch us.
No such thing as “HIPAA certified”
HIPAA asks for a signed BAA and real safeguards. Here are ours.
A signed BAA
With every practice, before anything connects.
Data stays in your office
Runs on your server, beside your practice software.
No partner without a BAA
Why texting waits for a signed BAA.
Your own mailbox
Receipts and summaries go out from your email.
Card numbers never touch us
Tokenized by the CardPointe terminal.
Minimum necessary
Reads only what reconciliation needs.
Evidence for disputes
Signed authorizations, kept with the record.
Independent checkpoint
A code and a count. No patient data.
How the software protects the practice
Personal logins
Own PIN. Locked after five wrong tries.
Logs out when idle
An unattended screen signs itself out.
Separation of duties
Whoever asks can never approve.
Tamper-evident ledger
Every record chained with SHA-256.
A copy off the machine
A rebuilt ledger can't match it.
Watch-only start
Posts nothing until you switch it on.
Patient links locked down
One patient, one day, nothing else.
Backups you control
Your drive or your business cloud.
Every change recorded
With the person's name.
Want our BAA or a security questionnaire? Ask us.