Security and HIPAA

Patient information is handled under a business associate agreement from day one, with the minimum data each task needs, limited access and a full audit trail.

BAA before go-live	Your center and Surgery Center Front Desk sign a business associate agreement before the first referral, chart or patient call.
Vendors under BAAs	Every vendor that touches patient information (voice, transcription, texting, hosting) signs a BAA with us.
Minimum necessary	Ava asks only what the task needs. Insurance ID numbers go through a secure form, not read aloud on a call.
Encryption	Data is encrypted in transit and at rest where our vendors provide it, and we choose vendors that do.
Access by role	Your staff see your center's work. On our side, access is limited to the people supporting your account.
Audit logs	Every chart created, call handled, auth request prepared and message sent is logged with who, what and when.
The public website	The forms on this site collect business contact details only, never patient information. Demo calls use a fictional center.

Incident response

If we learn of a security incident that affects your center's data, we notify you as your BAA requires and work with your team on next steps. To report a security concern, email danny@tryperegrine.com.

We do not claim SOC 2 or HITRUST certification. Ask us on the call for our current vendor list and BAA template.