Priced per provider, not per patient

No software is, and any vendor telling you otherwise is selling you a phrase rather than a control. HIPAA has no certification scheme. What we can tell you is specific: we sign a BAA, we encrypt PHI at rest and in transit, sensitive identifiers are encrypted at the field level with searchable blind indexes, access is role-based and logged to a hash-chained append-only audit trail, and tenant isolation is enforced by Postgres row-level security rather than by application code. Compliance is then a property of how your practice operates on top of that, which is why we also give you the reports an auditor will ask for.

In the region you choose at sign-up: United States, European Union, India, or the Gulf. The choice is fixed at that point because moving it later is a migration project rather than a settings change. Backups, object storage and error telemetry all follow the tenant's region — routing EU error traces to a US observability account is a residency breach that survives every other control, so we pin it explicitly.

Yes, and without asking us. Every tenant can export patients, encounters, orders, results and financials as FHIR R4 bundles or as CSV, on demand and via API. Enterprise tenants can stream the audit log into their own SIEM. Lock-in through export friction is a business model we would rather not have.

You export first, and we then follow the retention policy that applies to you. Deletion is not a DELETE statement: statutory medical-record retention runs from roughly 6 to 30 years depending on jurisdiction and patient age, so records move through a documented disposition lifecycle — retain, pseudonymise, crypto-shred — rather than vanishing on request. We will tell you exactly which floor applies to your jurisdiction.

The scripts are usually a competent CRUD application over a single shared database with tenant filtering in PHP. The difference shows up in the failure modes: a forgotten WHERE clause there leaks another clinic's patients, an editable audit table cannot answer a subject access request, and nobody ships a patch when a payer changes its edits. You are also buying maintenance — drug interaction data, payer rules and regulatory requirements all move, and a frozen codebase becomes unsafe rather than merely dated.

Only if you turn them on, and each one is a separate switch. When enabled, the relevant text goes to Anthropic under a BAA with zero data retention, which means it is not retained for training or for abuse monitoring. Anthropic is named in our public subprocessor register with direct PHI access, because pretending otherwise would be the dishonest option. Every call is metered and attributed, so you can see exactly what was sent and by whom.

A single-provider practice is usually seeing patients in the system the same week. A multi-site group with an existing EMR to migrate is typically four to eight weeks, most of which is data mapping and staff training rather than configuration. We import from CSV, from FHIR, and from the handful of legacy systems we have written parsers for.

Each plan includes a monthly credit allowance, and one credit is roughly one AI action of typical size. Top-ups are $9 per 1,000 credits. You can set a hard cap so the features stop rather than bill, which is the setting most practices choose in their first month. Unused credits do not roll over — we would rather price them low than pretend to bank them.

For Enterprise tenants with a genuine regulatory requirement, yes — a dedicated database shard in the region of your choice, and in a small number of cases a single-tenant deployment. It costs more and updates land more slowly, and we will say so during the sales process rather than after.