Security

Last updated: October 30, 2026

Security is part of how we work from the first conversation. This page describes the commitments and practices we apply to protected health information ("PHI").

Business Associate Agreement before any data

We do not access or receive PHI until a Business Associate Agreement ("BAA") has been executed with the customer. The BAA defines permitted uses and disclosures, safeguards, breach notification obligations, and the return or destruction of PHI at the end of the relationship.

HIPAA safeguards

We maintain administrative, physical and technical safeguards designed to be consistent with the HIPAA Security Rule, including documented security policies, periodic risk assessment and controls proportionate to the sensitivity of the data we handle.

Least-privilege integrations

Integrations with purchasing, billing, claims and payment systems are read-only wherever the workflow allows and scoped to the minimum data necessary for the agreed services. Access is granted per user and per integration, reviewed regularly, and revoked when no longer required.

Encryption

PHI is encrypted in transit using TLS and encrypted at rest using industry-standard encryption.

Access control and logging

Workforce access to PHI requires unique accounts and multi-factor authentication, and is limited by role. Access to systems containing PHI is logged and reviewed.

Vendors

Vendors that create, receive, maintain or transmit PHI on our behalf are evaluated for security and sign a BAA with us before handling PHI.

Website forms

The forms on this website are for business contact details only. Please don't submit patient information through them.

Questions

For security questions or to report a concern, call us at (617) 212-8153.