Security & Compliance

Built for the security requirements
of US surgical practices.

HIPAA-aligned infrastructure. BAA available on request. No PHI sold or shared.

🛡 HIPAA-aligned 📋 BAA available 🔒 AES-256 at rest 🇺🇸 US data residency
HIPAA Compliance Posture

Where we stand, plainly.

We align with HIPAA's three safeguard categories. Items marked In progress are actively being addressed — not claimed as complete.

🏛

Administrative Safeguards

  • In place Role-based access controls — staff see only their practice's data
  • In place Audit logging — all data access and changes are logged with timestamp and user
  • In progress Workforce HIPAA training program — annual training scheduled Q3 2026
  • In place Incident response plan — documented, tested annually
  • In place Business associate management — BAA in place with all sub-processors
  • In progress Annual security risk assessment — program initiated, completion scheduled Q4 2026
🏢

Physical Safeguards

  • In place Cloud-native infrastructure — all servers managed by Render (AWS) in US regions
  • In place Data residency — all patient data stored exclusively in US-based data centers
  • In place Encryption at rest — AES-256 for all stored data
  • In place Physical access controls — cloud provider enforces biometric/2FA for data center staff

Technical Safeguards

  • In place Encryption in transit — TLS 1.2+ enforced on all connections
  • In place Role-based access — staff accounts scoped to practice; no cross-practice visibility
  • In place Session timeouts — staff sessions expire after 30 minutes of inactivity
  • In place Auto-provisioning of access — no shared credentials; individual accounts required
  • In place Encrypted database connections — SSL required for all DB connections
  • In progress Multi-factor authentication (MFA) — rollout in progress, target Q3 2026
Business Associate Agreement

We sign a BAA with every paying practice.

Healthcare providers are covered entities under HIPAA. As their messaging vendor, we are a Business Associate and we take that designation seriously.

📄

Use our BAA

We provide a standard mutual BAA. Share your practice name and we'll send the agreement for your review and signature.

Request our BAA
📝

Send yours

Already have a BAA template? Send it over and we'll review and execute within one business day.

Submit your BAA

Contact: security@surgeoncaseflow.com — we respond within one business day.

SMS & TCPA Compliance

Clinical communication only. No marketing. No exceptions.

All SMS from CaseFlow is transactional — appointment reminders, pre-op checklists, post-op check-ins. We do not send marketing or promotional messages under any circumstances.

Consent capture

Opt-in language is displayed at appointment booking — patients explicitly agree to receive case-related SMS. Consent records are stored and timestamped.

Opt-out handling

Every outbound message supports standard keywords: STOP to unsubscribe, HELP for assistance. Opt-out requests are processed immediately and the contact is flagged to prevent further outreach.

Opt-out audit trail

All STOP/HELP replies are logged with timestamp. We maintain a suppression list so opt-outs are never re-messaged, even across practice switches.

Message types

We send pre-op reminders, post-op check-ins, appointment notifications, and cancellation updates. No marketing, promotional, or advertising messages are ever sent.

Data Handling

We store what's needed. Nothing more.

Patient data is scoped to what the product needs to function. We do not collect or store sensitive identifiers that aren't operationally necessary.

What we store

  • Patient first name
  • Mobile phone number
  • Procedure type
  • Surgery/appointment date
  • Appointment status (confirmed, pending, filled, cancelled)
  • SMS consent flag and timestamp
  • Opt-out status and timestamp

What we do not store

  • Social Security Numbers (SSN)
  • Insurance IDs or member numbers
  • Clinical notes or diagnosis codes
  • Payment card data (handled by Stripe)
  • Full date of birth (month + year only)
  • Medical record numbers (unless provided as appointment reference)
Data retention

Patient records are retained for 3 years after last activity or practice subscription end, whichever comes first. After that window, records are permanently deleted unless a longer retention obligation applies.

Deletion on request

Patients or practices can request immediate deletion of all patient data at any time. Requests are processed within 72 hours. Confirmation is sent to the requesting contact.

No data sold or shared

CaseFlow does not sell, rent, or share patient data with any third party for any purpose — advertising, research, or otherwise. Data is used exclusively to deliver the messaging service you've contracted for.

Sub-Processors

The tools we use — and why.

We use a small, focused set of vendors. Each has a BAA or equivalent data protection agreement in place.

Vendor What they do Data handled Status
Postmark Transactional email — subscription confirmations, BAA documents Practice admin email address Active
Twilio SMS delivery and inbound webhook routing Patient mobile number and message content Active
Stripe Monthly subscription billing and payment processing Card data (tokenized — we never see raw card numbers) Active
Render Application hosting and infrastructure Application data (all patient data lives here) Active
No Surprises Act Compliance

Good Faith Estimates — built in, not bolted on.

The federal No Surprises Act (effective January 1, 2022) requires practices to provide uninsured and self-pay patients with a written Good Faith Estimate (GFE) at least 3 business days before any scheduled service. Violations carry OIG penalties up to $10,000 per incident. CaseFlow automates compliance so nothing slips through.

⚖️

Auto-generated at scheduling

When a self-pay or uninsured patient is scheduled, CaseFlow automatically generates a GFE with itemized line items — surgeon fee, facility fee, anesthesia, implants, and post-op visits. No manual entry required.

📱

T-3d SMS delivery + e-signature

Three business days before surgery, the patient receives a bilingual (EN/ES) SMS link to their personalized GFE portal. They review itemized costs and acknowledge receipt — creating a timestamped compliance record.

🗂️

6-year CMS retention

All GFE records are retained for 6 years per CMS guidance, with audit trail covering delivery channel, delivery timestamp, and patient acknowledgment. Export quarterly compliance reports for auditors at any time.

🔔

$400 variance dispute tracking

If a final bill exceeds the GFE by more than $400, the case is automatically flagged. Staff manage the dispute workflow through the dashboard — filing, IDR assignment, and resolution are all tracked with status badges.

✓ CMS-compliant ✓ OIG-defensible audit trail ✓ Bilingual patient portal (EN/ES) ✓ Quarterly compliance export
Security Roadmap

Where we're headed — honest.

Buyers respect honesty more than badges. Here's what we're actively working toward.

In progress

SOC 2 Type II

We're in the early stages of SOC 2 Type II certification. Target audit completion: Q1 2027. We'll publish the report when available.

Planned

HITRUST CSF

Higher-order healthcare security certification. Currently in planning phase — not yet in active remediation. Target: 2027–2028.

In progress

Penetration Testing Cadence

Annual external penetration testing scheduled — first engagement in progress. Results will be reviewed internally and addressed. Bug bounty program under evaluation for 2027.

In progress

MFA for Staff Accounts

Multi-factor authentication rollout is in progress. Target completion: Q3 2026.

Certifications and audit reports will be published to this page as they're completed. If you need formal documentation for your compliance review, contact us.

💊

Opioid Stewardship & PDMP Compliance

Opioid prescribing is one of the highest-liability surfaces for surgical practices. CaseFlow enforces evidence-based controls at every step of the post-operative discharge workflow.

📋

DEA Audit Trail

Every PDMP query is logged with timestamp, querying provider, patient state, and result severity — exportable for DEA and state board reviews.

🗺️

State PDMP Mandate Config

50-state compliance config drives required-field enforcement, query frequency requirements, and naloxone mandate thresholds. Multi-state practices get correct rules per patient location automatically.

🚨

Naloxone Co-Rx Rules Engine

Auto-flags when CDC thresholds, state mandates (CA, VT, RI, OH), benzo co-prescribing, prior overdose history, or age ≥65 triggers co-prescription. Hard block on discharge checklist until acknowledged.

📉

MME/Day Monitoring

Every prescription is scored against CDC 2022 thresholds (50 MME/day caution, 90 MME/day high risk) with color-coded alerts for staff and surgeon-level scorecards.

📱

Bilingual Taper Schedule SMS

Day 1/3/5/7/10/14 SMS taper cadence in English & Spanish with dose reduction targets, pain coping tips, and a refill request link. Pulls directly from the prescribed taper schedule.

🔌

PDMP Adapter Pattern

Built with a clean adapter interface so real state PDMP APIs (Bamboo Health, Appriss) can replace the mock stub without code changes throughout the app. Query audit survives adapter swaps.

Refill Request Workflow

Patients submit pain level, current dose, and reason via a token-gated bilingual portal (/refill/:token). Requests auto-route to the nurse queue as a hard escalation when MME increase is requested, refill threshold is reached, or pain level ≥ 8 — before any approval action is possible.

🔐

Security questions?

For compliance questions, BAA requests, or security concerns — reach out directly.

security@surgeoncaseflow.com

We respond within one business day. For urgent matters, include "URGENT" in the subject line.