Certicare handles documents that contain patient information. This page states exactly how that information is protected, which services touch it, and what is disclosed to whom.
Every document on the platform is created by a licensed healthcare provider, and under HIPAA those providers are covered entities (the organizations HIPAA directly regulates). Certicare acts as their business associate: it renders the documents, keeps the issuance record, and answers verification requests on their behalf.
A Business Associate Agreement, or BAA, is the HIPAA contract that makes a vendor legally responsible for safeguarding patient information it handles. Certicare signs a BAA with every subscribing practice as part of onboarding, before the practice issues its first document.
These are the only services that store or transmit patient information for Certicare, and each one operates under a signed BAA.
Renders documents, stamps registered forms, and stores the issuance record. Data is encrypted in transit and encrypted at rest. The rendering service keeps no copy of a document after it is produced and writes no patient information to its logs.
BAA in placeCarries inbound and outbound verification faxes at 888-649-4931.
BAA in placeCarries verification and support email at verify@certicare.io and hello@certicare.io, with end-to-end encrypted storage.
BAA in placeProcesses subscription payments. Stripe receives billing information only. No patient information reaches Stripe, so no BAA is required.
A provider can register a form they have already completed and signed by uploading it to the portal. The file travels from the provider's browser to Certicare's document service and into storage, over encrypted connections, and every step of that path runs on Google Cloud under the BAA above. No other service receives it.
Verification requests are accepted in writing only, at certicare.io/verify, by email, or by fax. A clinician reviews each request individually, and the written answer confirms two things: that the document was issued, and that the copy submitted matches the issuance record.
Issuance records, including the document as issued, are retained for at least 7 years. That period is what keeps previously issued documents verifiable, including after a provider's subscription ends. Application and account records are kept as long as needed to operate the service and meet record-keeping obligations; the privacy policy covers requests to access, correct, or delete personal information.
All connections to the site and to the document service use TLS encryption in transit, and stored data is encrypted at rest. Access to patient information is limited to what operating the service requires, and every verification response is prepared by a clinician rather than generated automatically. If a breach of unsecured patient information ever occurs, affected practices are notified as the HIPAA Breach Notification Rule requires.
Questions about this page, or a security concern to report: hello@certicare.io.