Security & HIPAA

The short version

What is in place today

• Encryption. All traffic uses HTTPS. Stored data is encrypted at rest by our infrastructure providers.
• Per-practice isolation. Each practice's records live under its own identity, and which practice a request belongs to is derived from a verified sign-in token rather than anything the browser can set. One practice cannot read another's data, and this is enforced by the server, not by the interface.
• Access logging. Every time a treatment plan is opened, signed, exported or changed, we record who did it, which plan, when, and from what address. The log stores the plan's reference code rather than the patient's name, so the log itself is not a second copy of your patient list.
• Automatic sign-out. Staff sessions end after 25 minutes of inactivity, with a five-minute warning first. The patient iPad clears itself two minutes after a plan is signed, and after ten minutes of no interaction on an unsigned plan, so a device passed between patients does not keep the previous one's plan on screen.
• Clean sign-out. Signing out clears the session completely, so a shared front-desk computer does not carry one user's patient data into the next user's session.
• No patient data in error monitoring. Our error reporting is configured to exclude request contents and variable values, and we test this deliberately rather than assuming it.
• Application attestation on the database. Since September 1, 2026 our database refuses requests from anything that cannot prove it is the genuine TreatPath application — a script or bot with a stolen token still gets no answer. We ran this in monitoring mode for a week first and enabled enforcement only after 97% of traffic verified cleanly and the remainder was confirmed to be automated noise, not practices.
• Verified activation. A practice is activated either by subscription checkout tied to its own verified login, or by a single-use access code from our team that works once and cannot be forwarded or reused. Card payments are handled by Stripe; card numbers never reach TreatPath.
• Backups. Point-in-time recovery is enabled on our database.

Where your data goes

Three outside services are involved, and we would rather name the categories plainly than bury them:

• A cloud database provider stores your treatment plans — the patient's name (and an optional chart number), the procedures, fees, insurance amounts and any captured signature. TreatPath does not collect date of birth, Social Security number, insurance member ID, or medical history.
• An AI provider receives the treatment plan image when you use the scan feature, in order to read the procedures and fees from it.
• A mail relay carries the take-home copy of a plan — to the address the patient enters on the tablet, or the address your staff enter when sending a copy after the visit. Nothing is emailed unless someone asks for it.

Nothing else leaves the system. We have executed Business Associate Agreements covering all four functions — database, hosting, AI and mail — each on a HIPAA-configured environment, and we will confirm their status to any practice that asks. In August 2026 we moved our application hosting onto the same covered cloud platform as the database, so that every service which can touch patient information now sits under an executed agreement.

Request a BAA

Email support@gettreatpath.com and we will send our Business Associate Agreement for your review. If your compliance officer has questions about anything on this page, we are happy to answer them directly.

Reporting a security issue

If you believe you have found a vulnerability in TreatPath, email support@gettreatpath.com with the details. We will acknowledge your report and keep you updated on the fix. Please do not access, modify or retain any data that is not yours while investigating.