Security
This page describes controls that are in the product today. It does not describe a certification we have not completed.
Sign-in
The secure workspace requires a password and a second step from an authenticator app. A password alone does not open patient lists. After five failed attempts the account locks for 15 minutes.
Idle sign-out
A session ends after 15 minutes without activity. There is also a maximum session length of 12 hours. Staff sign in again, including the second step, to continue.
Roles
Owners and admins see the organization. Billers, coders, front desk and clinic managers see the clinics they are assigned to. The audit log export is limited to owners. Website leads from this marketing site are visible to owners and admins.
Audit log
Sign-ins and views or changes of patient records are written to an append-only log. The application does not update or delete those rows. Owners can export the log.
Patient information
We sign a business associate agreement before handling any patient data for a client. The forms on this website ask you not to send patient names or records. The public demo keeps fictional patients in the browser and is not the secure workspace.