Industries
The open-text-field gap, and the architecture that closes it, look the same whether you straighten teeth or read MRIs. Here is how it lands in the practices we build for.
Compliance for every practice
Same gap, different vocabulary. Below, the way it tends to show up in each practice we build for, and the part of the build that closes it.
The message box you added for office hours is where a patient tells you an implant has felt loose for a week. That is protected health information, sitting in an inbox that was never built to hold it.
The note about the implant still reaches your front desk, in the inbox they already check. What changes is behind it: our HIPAA-compliant datastore holds the intake, and that mailbox is brought under a BAA.
Consult requests come from parents, not patients. “My daughter is 11 and probably needs braces” is a minor’s health information, typed into a field your site logs, emails, and backs up.
Your treatment coordinator works the consult queue exactly as they do today. The difference sits underneath it: a minor’s information is ours to hold, and every party that handles it afterward, your email provider included, is under a signed agreement.
Patients describe the thing they want looked at, and then they attach a picture of it. A rash, a mole that changed, a note about the medication they are already on.
Patients still send the photo, and your team still sees it. The image and the description are covered from the moment they arrive, and your website is never the place either one comes to rest.
A quiet question about scar revision after surgery is exactly the message a patient assumes is private. On most practice sites it is forwarded, logged, and stored in three places.
Discretion is the product, so the inquiry is handled the way your patients already assume it is. It sits in our HIPAA-compliant datastore, the agreement runs through to whoever reads it, and your site holds none of it.
“Chronic back pain and sciatica” is how a new patient introduces themselves in a free-text box. Your site records it, mails it, and keeps it.
The box stays, and so does the detail that helps you plan the first visit. Your site is simply no longer the place that detail lives, and the inbox your team works from is covered too.
Self-referrals arrive with the diagnosis attached, like a knee replacement that is still swelling weeks later. The detail that helps you triage is the same detail that puts you at risk.
You keep the diagnosis you need in order to triage and schedule. We keep it in our HIPAA-compliant datastore, with the agreement extended to the mailbox your front desk actually works out of.
“I think I need to talk to someone about my anxiety” is often the first thing a patient ever tells you, and it is the most sensitive data your website will ever touch.
The first thing a patient tells you is the first thing we cover: under a BAA from the moment they send it to the inbox your clinician opens, and never a word of it left on your website.
Refills are the highest-volume message a practice site gets. “I need a refill on my thyroid medication” names a condition and a drug, which is about as protected as data gets.
Your highest-volume message becomes your best-covered one. Refill and appointment requests are captured in our HIPAA-compliant datastore, and the inbox your staff clears each morning is brought under the same agreement.
The line between an aesthetic service and a medical one moves the moment a client mentions the medication they take or the condition they are treating. Your booking form cannot tell the difference.
Booking works the same for the client who mentions a medication and the client who does not, because both are covered. The form never has to tell the difference, and your site is not where either one is kept.
Appointment requests carry a reason: new floaters, blurred vision since a fall, a diabetic eye exam that is overdue. Each one names a condition in plain text.
Your schedulers keep the reason for the visit, which is what makes the slot the right length. Coverage travels with it, all the way to the mailbox they live in: Google Workspace, Microsoft 365, whichever one you run.
New-patient messages mention a pregnancy, a due date, or a result the patient wants to talk through. Few categories of health information are more sensitive, or more closely watched.
The most closely watched information in medicine gets the plainest answer we have. It is held in our HIPAA-compliant datastore, and we sign the BAA for every step of the path it travels, the mailbox at the end included.
Patients and referring offices send specifics: chest tightness on the stairs, a device check, a report pasted into the notes field because there was nowhere else to put it.
Referrals arrive with the clinical detail intact, which is the part that makes them worth reading. We hold that detail, the agreement covers everyone who handles it, and your website ends up holding none of it.
A parent writes on behalf of a child and includes everything: the fever, the rash, the medication, the child’s name and age. Records for minors carry their own scrutiny.
The parent’s message arrives whole, and your nurses read it where they always have. A minor’s record stays covered the entire way through, and the one place it is never kept is your website.
Patients type the symptoms they would rather not say out loud, into the only box your site gives them. It is candid, it is useful, and it is protected health information.
Patients stay candid, which is what gets them the right appointment. What they type is covered when it arrives and still covered when it is read, and your website is never the thing holding it.
Endocrinology, fertility, sleep medicine, urgent care, pain management, even veterinary. If a patient can type protected information into your site, the exposure and the fix are the same. Not listed here? The free audit still applies.
Start here
The free audit reads only what is publicly available: your live site, its forms, where a submission appears to go, and the third parties already riding along on the page. We never touch your systems, and all we need is your URL. You get your likely exposure in writing, at no cost.