Security

claimhard handles billing data, so here is what we do about it, stated plainly enough to check.

HIPAA and your agreement

claimhard is HIPAA compliant, and we sign a BAA with every customer. It is hosted on AWS, which is also under a BAA.

Your data stays yours

Each customer's data is separated in the database itself, using row-level tenant isolation, not just in the application. The dashboard and the background worker connect with separate database roles, the worker's reporting uses a third, and the patient portal connects with a fourth that holds no table access at all. Each role is limited to its own list of tables and functions, and no role holds delete permission on any table.

Identifiers

Medicare numbers (MBIs) show as the last four characters by default. A signed-in member can reveal one in full when they ask. Tax IDs and MBIs are never written to logs, error messages or CI output.

Patient names are visible to signed-in members, as a billing tool needs.

Credentials

The Claim.MD and Availity credentials are held only by the background worker, never by the dashboard or a person's session.

The bank link is different. Plaid is set up by an admin in the dashboard, and after that the worker pulls deposits.

What claimhard writes to other systems

claimhard never submits, corrects, appeals or deletes a claim. It does make paid Medicare eligibility checks for patients, but only when they are switched on for that customer. It also manages the bank link it was given, connecting and disconnecting it. Everything else it does with claim, payer and bank systems is a read.

AI

When someone asks for an AI explanation of a denial, the model sees codes, amounts, the payer and the line of business. It never sees a patient, an MBI, an account number, a date or a provider. Its answer is advice only: it cannot change a rule result or a claim.

Signing in

Sign-in is invitation-only, through Microsoft Entra single sign-on. A person grants access; nobody can sign themselves up.

Certifications

No certifications are claimed. We do not hold SOC 2 or HITRUST, and we will not say we do.

Questions about any of this? Talk to us.