Security & HIPAA

The short version

What is in place today

• Encryption. All traffic uses HTTPS. Stored data is encrypted at rest by our infrastructure providers.
• Per-practice isolation. Each practice's records live under its own identity. The server works out which practice a request belongs to from a verified sign-in token, never from anything the browser can set. One practice can't read another's data, and that's enforced on the server, so it doesn't depend on the interface.
• Access logging. We log every time a treatment plan is opened, signed, exported or emailed, and every time staff mark it signed, upgrade it, record a decline or add a note. Each entry records who did it, which plan, when, and from what address. The log stores the plan's reference code instead of the patient's name, so it doesn't become a second copy of your patient list.
• Automatic sign-out. Every team member signs in with a personal PIN, and their session locks back to the PIN screen after 20 minutes without activity. The practice's own sign-in ends after eight hours of inactivity, with a five-minute warning first. The patient iPad clears itself two minutes after a plan is signed, and after ten minutes of no interaction on an unsigned plan, so a device passed between patients does not keep the previous one's plan on screen.
• Paired iPads. A practice can pair each iPad once with a single-use code that expires in ten minutes. We store the iPad’s token only as a one-way hash, and forgetting the iPad in the dashboard stops it at once. On its own a paired iPad shows nothing about any patient. A team member’s PIN (same lockout as the dashboard) opens the day’s unsigned plans by first name and last initial, with no procedures or fees. The list locks after five idle minutes, ends after fifteen, and closes before a plan is shown; every exit from a plan returns to the start screen.
• Clean sign-out. Signing out clears the session completely, so a shared front-desk computer does not carry one user's patient data into the next user's session.
• No patient data in error monitoring. Our error reporting is configured to exclude request contents and variable values, and we test that it does.
• Application attestation on the database. Since September 1, 2026, our database refuses requests from anything that can't prove it's the real TreatPath application. A script or bot with a stolen token still gets no answer. We ran this in monitoring mode for a week first, and turned on enforcement only after 97% of traffic verified cleanly and we'd confirmed the rest was automated noise, not practices.
• Verified activation. A practice is activated either by subscription checkout tied to its own verified login, or by a single-use access code from our team that works once and cannot be forwarded or reused. Card payments are handled by Stripe; card numbers never reach TreatPath.
• Backups. Point-in-time recovery is enabled on our database.

Where your data goes

Four outside services handle patient information. They're the same four listed in our Business Associate Agreement:

• A cloud database provider stores your treatment plans: the patient's name (and an optional chart number), the procedures, fees, insurance amounts and any captured signature. It also stores the details your team adds: the patient's communication style if one is selected, decline reasons, short staff notes, and the names your practice gives its paired iPads. The access log is kept there too. TreatPath does not ask for date of birth, Social Security number, insurance member ID, or medical history.
• A cloud hosting provider runs the application, so plan data passes through it on the way to and from the database. Its standard request logs record plan codes, network addresses and browser details.
• An AI provider reads the treatment plan you scan (and an insurance eligibility report, if you scan one) to pull out the procedures and amounts. It also receives a plan's procedure list, without the patient's name, to write the plain-language descriptions patients see and to suggest bundles. For the daily summary, it receives the reasons patients type when declining a plan, without names attached.
• A mail relay carries the take-home copy of a plan to the address the patient enters on the tablet, or to the address your staff enter when sending a copy after the visit. Nothing is emailed unless someone asks for it. Replies go to your practice’s own email address, which you save in Settings. TreatPath doesn’t send a copy until it’s saved.

No other outside service receives patient information. Card payments are handled by Stripe, which receives practice billing details only. We have executed Business Associate Agreements covering all four (database, hosting, AI and mail), each on a HIPAA-configured environment, and we'll confirm their status to any practice that asks. In August 2026 we moved our application hosting onto the same covered cloud platform as the database, so every service that can touch patient information is now under an executed agreement.

Our Business Associate Agreement

Our Business Associate Agreement is published at gettreatpath.com/baa and is accepted with the Terms of Service when your practice signs up; that acceptance is your practice's signature. A countersigned copy, or a version to sign separately, is available from support@gettreatpath.com. If your compliance officer has questions about anything on this page, we'll answer them directly.

Reporting a security issue

If you believe you have found a vulnerability in TreatPath, email support@gettreatpath.com with the details. We will acknowledge your report and keep you updated on the fix. Please do not access, modify or retain any data that is not yours while investigating.