Security & compliance

The AI drafts. A licensed clinician decides.

The whole system is built on one rule: the AI does the busywork, but nothing clinical is final until a licensed clinician signs it, and nothing financial is final until a person on your team approves it. On HIPAA-aligned, BAA-covered infrastructure.

The hard line

A human always signs

Every clinical AI output is a draft until a licensed clinician reviews and approves it. The AI can draft a note, suggest codes, prepare a prescription for review, or assemble a claim — it can't send, prescribe, or bill on its own.

Provider-reviewed AI

No autonomous clinical or billing actions — a person approves everything that counts.

BAA-covered infrastructure

Runs on business-associate-agreement infrastructure, HIPAA-aligned end to end.

Encrypted in motion and at rest

Patient data is encrypted while it moves and while it's stored. Passwords and keys are kept in a separate secure vault.

Role-based access

Each person sees only what their job needs. One sign-in covers the whole platform.

Full audit trail

Every action — human or AI — is logged with who, what, and when. Nothing happens off the record.

The AI can't change its own rules

The limits on what the AI can do are set outside the AI. It can't loosen them.

In plain terms: the AI removes the typing, the phone tag, and the coding busywork. It does not practice medicine, and it does not touch money on its own. A licensed clinician is on every clinical decision, and every dollar waits for a person. Building a home-health agency? See how the same guardrails apply on the Home Health page.

Questions about compliance?

We'll walk your compliance team through how it works and the BAA.

Book a security walkthrough