How we are different
Most differences between health software products are features — a nicer scheduler, a faster note. The differences that matter to a practice five years in are structural: what happens to your books when your billing model changes, what you can prove when someone asks, and what a control actually enforces when nobody is looking at the screen.
Everything on this page is a decision in the architecture, not a claim about anyone else.
What was missing
These are the conditions we kept running into when we looked at what independent practices were actually being offered. Each one is followed by the specific thing we built in response.
Cash-pay tools store charges as free text and cannot grow into a payer contract. Claims-first systems bury a cash practice in machinery it will never use. Changing your mix means changing systems — and re-keying your history.
What we built
One coded charge ledger underneath both models, chosen per encounter. Payer connections attach at the edge, so adding insurance adds an adapter, not a migration.
When a patient asks who opened their chart, or an auditor asks what an account touched last quarter, the answer comes from someone else’s logging pipeline — on their timetable, in their format, with no way to show the record was not edited after the fact.
What we built
An append-only, hash-chained audit trail the practice can read itself, with a correlation id that gathers everything one request did. Breaking the chain is detectable.
Roles hide menus while the API underneath returns the whole record. The control looks real in a demo and is one request away from not existing.
What we built
Deny-by-default decisions carry a field-level minimum-necessary scope applied to the data returned. Hiding a tab is not the control; the shape of the response is.
A model drafts a note and nobody can say afterwards which model, what it was allowed to see, whether a human approved it, or what would have happened if none had.
What we built
Every model call goes through one gateway that knows the workflow, its risk tier, and whether the payload contains PHI. Autonomy is a per-domain setting your practice owns, and the clinical default is human sign-off.
A logo on a marketing page and a signed BAA say a vendor passed an audit at a point in time. Neither tells you what happens on the request you are about to make.
What we built
Named mechanisms mapped to the Security Rule safeguards they implement, exercised by a test suite that is a required merge gate — a change that weakens a control cannot ship.
Export means a support request, a CSV of the parts they choose, and none of the audit history that made the record trustworthy in the first place.
What we built
A patient’s whole portal record as a FHIR file, group-scoped FHIR Bulk Data export through an approved app, a record integrity report an auditor can check, and FHIR R4 mapping throughout. A whole-practice exit, with the audit trail for your tenure, is a supported engagement rather than a button: there is no self-serve practice-wide export yet.
How the platform is built differently
Each one names a mechanism rather than a quality. If a claim here cannot be pointed at something in the system, it does not belong on this page.
Cash pay and insurance run on the same coded charge ledger, decided per encounter. Practices that change their mix — most of them, eventually — change a setting rather than a platform.
Coded charges, one ledger, payer connections as edge adapters
Every request runs tenant, then role, then attributes before a handler executes, and the decision carries the field-level scope of what may come back. There is no screen-level shortcut, because the screen is not where the control lives.
Deny-by-default pipeline with minimum-necessary scope on every decision
Events are append-only and hash-chained, each committing to the one before it, and they belong to the practice rather than to an internal observability stack. An auditor gets the chain, not a screenshot.
Tamper-evident chain with correlation ids
No product code calls a model directly. A single gateway attaches the workflow, risk tier, and PHI flag to every call, refuses providers not eligible for the payload, and records the proposal as well as the execution.
One governed gateway with PHI and BAA gating; no product code reaches a model without it
Sign-in happens at your identity provider, so the platform never handles a password. The second factor is a passkey bound to your practice’s own address — it will not be offered on a look-alike site, and it cannot be read aloud to whoever is on the phone claiming to be IT.
Practice-scoped WebAuthn for sign-in and step-up; bring your own SSO
Shared with row-level security, your own database, or your own stack and encryption key — the same application code, selected by configuration. Growing into a stricter boundary is not a re-platforming project.
Three isolation tiers behind one code path
Authorization, tenant isolation, deny-by-default, audit emission, and PHI minimization are covered by a security suite that must pass before anything merges. The control is a test, not a paragraph in a policy document.
test:security as a required CI gate
A tamper-evident log tells you the vendor checked their own records and found nothing wrong — which is only as good as the vendor. Here every consequential act enters a Merkle log, and you keep short signed receipts for it somewhere we cannot reach. Later you can demand proof that the log still contains everything a receipt covered. If anything had been removed, reordered, or rewritten, no such proof exists, and no amount of access to our own infrastructure would produce one.
RFC 6962 transparency log, Ed25519 checkpoints; the verification key is served to staff the practice authorises, not on a public route
When a clinician signs, their device signs a fingerprint of the exact text on screen. Change one character afterwards and the signature stops verifying — so "the note said this when I signed it" becomes something anybody can check rather than something they assert. Signed records cannot be edited by them, by the practice owner, or by us; corrections are amendments that name the original.
Content hash as the WebAuthn challenge; immutability enforced in one place
The DEA requires two-factor authentication at each signing. The usual implementation authenticates against a random challenge, which proves somebody was present but not which prescription was in front of them. Here the challenge IS the prescription — a hash of the exact block displayed — so the practitioner’s own key signs the drug, the quantity, the directions and the DEA number. Change any of them after the review and the signature simply fails to verify.
Content hash as the WebAuthn challenge; one ceremony signs one prescription
Controlled-substance signing is held by no role. It is granted per practitioner and per schedule by two people — one proposing, a DEA registrant approving with their own credential — which is what the regulation requires and what stops whoever administers accounts from quietly becoming a prescriber. Revocation is one person and takes seconds, because taking authority away should never be the hard direction.
Logical access control entries, not role assignments (21 CFR 1311.125)
What has been implemented is stated alongside what has not been independently verified. A buyer who reads carefully should be able to trust the rest of the page because of it.
Published compliance status, no claimed certifications
The through-line
Put the thing that is hard to change later into the foundation, and leave the thing that changes often at the edge. Billing model, isolation tier, model provider, and identity provider are all edges. The coded ledger, the authorization pipeline, and the audit chain are the foundation — because a practice cannot retrofit any of them once its records depend on them.
The demo is thirty minutes on synthetic data, and the part worth watching is the audit chain at the end — every step of the walkthrough coming back in order, including the AI action we stopped.
Forged Med states what has and has not been independently verified on its compliance status section.
