Built HIPAA-first.
Compliance is designed in from the first line of code. Here’s what that means in practice, and what we don’t claim.
Agreements
- A Business Associate Agreement (BAA) with every practice.
- A BAA with every vendor that touches patient data, including our texting provider.
Access to patient data
- All patient data passes through one audited, encrypted gate.
- Role-based access: each person sees only what their role needs.
- An audit log of every action on patient data.
Texting consent and opt-out
- Families are texted only with consent, from the practice’s own registered number.
- STOP suppresses that channel instantly.
- Built for the FCC “revoke-all” consent rule, effective January 31, 2027.
- 10DLC carrier registration for each practice.
Respectful by default
- No texts between 8pm and 8am.
- Messages for minors go to the responsible adult.
- Message templates are informational, not promotional.
What we don’t claim
We claim only certifications we actually hold. Today, we hold none. We describe our safeguards instead of displaying badges.
We don’t integrate with your practice-management software. Your TC uploads the report it already exports.
This website collects no patient information
Our forms ask only for your work contact details and practice-level numbers. There are no free-text fields about patients. Please don’t send patient information through this site or by email.
We use privacy-friendly analytics (Plausible) with no session replay and no ad pixels. See our Privacy Policy.
Questions about security? Email hello@citrine.example.
Let’s look at your pending list together.
A 20-minute call. We’ll look at your pending list and what’s at stake, and show you how the follow-up works.
Get my free Pending-List Review Not ready for a call? Run the numbers first