Security
Boring on purpose.
A clinical operations layer earns trust with verified controls, not adjectives. This page lists what is actually in place — nothing aspirational, nothing implied.
HIPAA-aligned operations. Business Associate Agreements in place with covered entities.
Practice-scoped access. Each practice's data is isolated to its own environment — access is scoped, never pooled.
Encryption. Data encrypted in transit and at rest.
Access logging. PHI surfaces carry access logs; actions are attributable.
Environment isolation. Practices run in isolated environments; one practice's workload cannot see another's.
athenaOne write boundaries. OpAgent writes only where explicitly permitted, and every write is attributable to a reviewed action.
Human review. A clinician reviews and signs clinical outputs. That is the design, not a disclaimer.
SOC 2 in progress. A SOC 2 engagement is underway. We say "in progress" because it is — not "certified" until it is.
Questions about the posture — BAAs, data handling, or the athenaOne integration boundaries — are welcome in a demo conversation.